Electron up to 38.8.5/39.8.0/40.8.0/40.x Instance Message app.requestSingleInstanceLock out-of-bounds

Summaryinfo

A vulnerability marked as critical has been reported in Electron up to 38.8.5/39.8.0/40.8.0/40.x. The impacted element is the function app.requestSingleInstanceLock of the component Instance Message Handler. This manipulation causes out-of-bounds. The identification of this vulnerability is CVE-2026-34776. The attack can only be executed locally. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Electron up to 38.8.5/39.8.0/40.8.0/40.x. It has been declared as critical. Affected by this vulnerability is the function app.requestSingleInstanceLock of the component Instance Message Handler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-34776 since 03/30/2026. The exploitation appears to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 38.8.6, 39.8.1, 40.8.1 or 41.0.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Electron

Version

• 38.8.0
• 38.8.1
• 38.8.2
• 38.8.3
• 38.8.4
• 38.8.5
• 39.0
• 39.1
• 39.2
• 39.3
• 39.4
• 39.5
• 39.6
• 39.7
• 39.8.0
• 40.0
• 40.1
• 40.2
• 40.3
• 40.4
• 40.5
• 40.6
• 40.7
• 40.8.0
• 40.x

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion