PT-2026-30000 · Electron · Electron

Published 2026-04-03 · Updated 2026-04-04 · CVE-2026-34770

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Electron versions prior to 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8

Description Electron applications utilizing the powerMonitor module may experience a use-after-free condition. Following the garbage collection of the native PowerMonitor object, OS-level resources retain references to freed memory. Subsequent system events, such as session changes on Windows or system shutdown on macOS, can then dereference this freed memory, potentially leading to crashes or memory corruption. Applications accessing powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected.

Recommendations Update to Electron version 38.8.6 or later Update to Electron version 39.8.1 or later Update to Electron version 40.8.0 or later Update to Electron version 41.0.0-beta.8 or later

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-34770

GHSA-JJP3-MQ3X-295M

Affected Products

Electron

References · 7

• https://github.com/electron/electron/security/advisories/GHSA-jjp3-mq3x-295m · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jjp3-mq3x-295m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34770 · Security Note
• https://github.com/electron/electron · Note
• https://twitter.com/infoflowcloud/status/2040482455451308174 · Twitter Post
• https://twitter.com/SeedVEVO/status/2039982997689286963 · Twitter Post
• https://twitter.com/CVEnew/status/2040481270296379594 · Twitter Post