Electron up to 39.8.4/40.8.4/41.0.x release use after free

Summaryinfo

A vulnerability was found in Electron up to 39.8.4/40.8.4/41.0.x. It has been classified as critical. This issue affects the function release. The manipulation leads to use after free. This vulnerability is referenced as CVE-2026-34764. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Electron up to 39.8.4/40.8.4/41.0.x. It has been rated as problematic. This issue affects the function release. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is availability. The summary by CVE is:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Under certain conditions, the release() callback provided on a paint event texture can outlive its backing native state, and invoking it after that point dereferences freed memory in the main process, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering with webPreferences.offscreen: { useSharedTexture: true }. Apps that do not enable shared-texture offscreen rendering are not affected. To mitigate this issue, ensure texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-34764 since 03/30/2026. The exploitation is known to be easy. Attacking locally is a requirement. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 39.8.5, 40.8.5, 41.1.0 or 42.0.0-alpha.5 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Electron

Version

• 39.8.0
• 39.8.1
• 39.8.2
• 39.8.3
• 39.8.4
• 40.8.0
• 40.8.1
• 40.8.2
• 40.8.3
• 40.8.4
• 41.0

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion