PT-2026-30919 · Electron · Electron

Frostb1Ten · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-34781

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.5, prior to 40.8.5, prior to 41.1.0, and prior to 42.0.0-alpha.5

Description Applications utilizing the clipboard.readImage() function may experience a denial of service. If the system clipboard contains image data that cannot be decoded, the resulting null bitmap can cause a process crash. Only applications that call clipboard.readImage() are affected. This issue does not allow memory corruption or code execution. A workaround is to validate the clipboard contains image data via clipboard.availableFormats() before calling clipboard.readImage().

Recommendations Update to Electron version 39.8.5 or later. Update to Electron version 40.8.5 or later. Update to Electron version 41.1.0 or later. Update to Electron version 42.0.0-alpha.5 or later.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-34781

GHSA-F37V-82C4-4X64

Affected Products

Electron

References · 12

• https://github.com/electron/electron/security/advisories/GHSA-f37v-82c4-4x64 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f37v-82c4-4x64 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34781 · Security Note
• https://github.com/electron/electron/releases/tag/v39.8.5 · Note
• https://github.com/electron/electron/pull/50475 · Note
• https://github.com/electron/electron/commit/a48f03fb8d03933547281ddb2dbb6c6b9e705287 · Note
• https://github.com/electron/electron/releases/tag/v41.1.0 · Note
• https://github.com/electron/electron/releases/tag/v40.8.5 · Note
• https://github.com/electron/electron/releases/tag/v42.0.0-alpha.5 · Note
• https://github.com/electron/electron · Note
• https://twitter.com/VulmonFeeds/status/2041688689823068399 · Twitter Post
• https://twitter.com/CVEnew/status/2041711867308257628 · Twitter Post