PT-2026-30277 · Electron · Electron

Daffainfo

·

Published

2026-04-03

·

Updated

2026-05-01

·

CVE-2026-34764

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Electron versions 33.0.0-alpha.1 through 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5
Description Electron applications utilizing offscreen rendering with GPU shared textures may experience a use-after-free condition. Specifically, the release() callback associated with a paint event texture can outlive its native state, potentially leading to memory corruption or a crash when invoked. Applications are only affected if they employ offscreen rendering with webPreferences.offscreen: { useSharedTexture: true }. The texture.release() function is central to this issue.
Recommendations Versions prior to 39.8.5: Ensure texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable. Versions prior to 40.8.5: Ensure texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable. Versions prior to 41.1.0: Ensure texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable. Versions prior to 42.0.0-alpha.5: Ensure texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-34764
GHSA-8X5Q-PVF5-64MP

Affected Products

Electron