CVE-2026-34776
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Electron before versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0 on macOS and Linux has an out-of-bounds heap read vulnerability when parsing a crafted second-instance message if the app calls app.requestSingleInstanceLock(). Leaked memory can be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Windows is not affected.
Risk Assessment
A local attacker can read heap memory fragments, potentially exposing sensitive data such as keys or passwords stored in the application's memory.
Recommendation
Update Electron to version 38.8.6, 39.8.1, 40.8.1, or 41.0.0, depending on the major version in use.
Original NVD description (English source)
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.