CVE-2024-29900 - CVE House
Back to Database
Status published High CVE-2024-29900

@electron/packager's build process memory potentially leaked into final executable

Vulnerability Description

Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-29900

Credits & Attribution

No credits recorded in the NVD database.

References

More from electron

View All →
CVE-2025-55305
Electron is vulnerable to Code Injection via resource modification
Medium 6.1
CVE-2024-46993
Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPath
Medium 4.4
CVE-2024-46992
Electron ASAR Integrity bypass by just modifying the content
High 7.8
CVE-2023-44402
ASAR Integrity bypass via filetype confusion in electron
Medium 6.1
CVE-2023-39956
Electron: Out-of-package code execution when launched with arbitrary cwd
Medium 6.1

Affected Vendor

Affected Software

packager
Vulnerable Versions:
= 18.3.0

Timeline

Official Publish: March 29th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-402

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.