CVE catalog
CVE-2026-34764
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that use offscree
- Severity
- Low · CVSS 2.3
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.10% · Oct 25, 2026
A flaw was found in Electron, a framework for building desktop applications. This vulnerability, a use-after-free, affects applications that utilize offscreen rendering with GPU shared textures. Under specific conditions, a callback function can attempt to access memory that has already been released, leading to a crash or memory corruption. This issue specifically impacts applications configured with `webPreferences.offscreen: { useSharedTexture: true }`. Electron: Electron: Memory corruption or crash due to use-after-free in offscreen rendering with shared textures. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | electron | Not reported | 39.8.5 | fixed |
| Cpe | electron | Not reported | 40.8.5 | fixed |
| Cpe | electron | Not reported | 41.1.0 | fixed |
| Cpe | electron | Not reported | Not reported | unknown |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | electron | cpe | Not reported | 39.8.5 | Not reported | Not reported | Not reported |
| Cpe | electron | cpe | Not reported | 40.8.5 | Not reported | Not reported | Not reported |
| Cpe | electron | cpe | Not reported | 41.1.0 | Not reported | Not reported | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: