PT-2026-30006 · Electron · Electron

Published 2026-04-03 · Updated 2026-04-27 · CVE-2026-34776

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Electron versions prior to 38.8.6, 39.8.1, 40.8.1, and 41.0.0

Description Electron applications calling app.requestSingleInstanceLock() on macOS and Linux were susceptible to an out-of-bounds heap read when processing a specially crafted second-instance message. This could lead to memory leakage delivered to the app's second-instance event handler. The issue is confined to processes running under the same user account as the Electron application. Applications not utilizing app.requestSingleInstanceLock() are not affected. Windows is not impacted by this issue.

Recommendations Update to Electron version 38.8.6 or later Update to Electron version 39.8.1 or later Update to Electron version 40.8.1 or later Update to Electron version 41.0.0 or later

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-34776

GHSA-3C8V-CFP5-9885

Affected Products

Electron

References · 7

• https://github.com/electron/electron/security/advisories/GHSA-3c8v-cfp5-9885 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34776 · Security Note
• https://osv.dev/vulnerability/GHSA-3c8v-cfp5-9885 · Vendor Advisory
• https://github.com/electron/electron · Note
• https://twitter.com/infoflowcloud/status/2040482451345055901 · Twitter Post
• https://t.me/cveNotify/161068 · Telegram Post
• https://twitter.com/CVEnew/status/2040481263379939687 · Twitter Post