CVE-2026-54257Critical▾ MidnightElectron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.4%
Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation.
No workarounds. Do not use these impacted Electron releases
42.3.3If you have any questions or comments about this advisory, email us at [email protected]
electron >= 42.3.1, < 42.3.3Upgrade to a patched release:
electron 42.3.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115570High· 7.4Electron: Mitigation for compromised eMudhra intermediate certificates
CVE-2026-114124Low· 3.9Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
CVE-2026-113796Medium· 4.2Electron: SameSite cookie restrictions are not applied to windows opened from links
CVE-2026-113797Low· 3.1Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
CVE-2026-113798Medium· 5.4Electron: Pointer lock permission requests can be attributed to the wrong frame
CVE-2026-113800Medium· 5.4Electron: HID and USB permission checks can be attributed to the wrong origin