CVE-2026-54257

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.1 until 42.3.3, Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow. Most apps will crash and some may perform incorrect buffer allocations in the Node.js Buffer API resulting in unexpected truncation or allocation. This vulnerability is fixed in 42.3.3.

Affected products

Electron, Node.Js

Fix

Available

CVSS 4.0

9.3 CRITICAL

EPSS

0.3% (17th percentile)

Weakness

CWE-120

NVD status

Deferred

Published

2026-06-23

No exploit for CVE-2026-54257 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.