Use-After-Free Vulnerability in Electron Framework Impacting Desktop Applications
CVE-2026-34764

2.3LOW

Key Information:

Vendor

Electron

Status
Electron
Vendor
CVE Published:
6 April 2026

What is CVE-2026-34764?

The Electron framework, used for building cross-platform desktop applications, has a vulnerability concerning offscreen rendering with GPU shared textures. This flaw affects versions from 33.0.0-alpha.1 up to, but not including, 39.8.5, along with versions 40.8.5, 41.1.0, and 42.0.0-alpha.5. When the paint event texture's release() callback persists beyond the lifespan of its backing native state, an application may dereference freed memory, which can result in crashes or memory corruption. Vulnerable applications must implement timely calls to texture.release() after use to mitigate the risk. This issue has been addressed in specified newer versions of Electron.

Affected Version(s)

electron >= 33.0.0-alpha.1, < 39.8.5 < 33.0.0-alpha.1, 39.8.5

electron >= 40.0.0-alpha.1, < 40.8.5 < 40.0.0-alpha.1, 40.8.5

electron >= 41.0.0-alpha.1, < 41.1.0 < 41.0.0-alpha.1, 41.1.0

References

https://github.com/electron/electron/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.