Vulnerability · Published Apr 3, 2026 · Assigned by GitHub_M

CVE-2026-34776Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Medium 5.3

In plain English

A medium-severity out-of-bounds read in electron from electron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 87.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	electron	38.8.6	GHSA-3c8v-cfp5-9885
npm	electron	39.8.1	GHSA-3c8v-cfp5-9885
npm	electron	40.8.1	GHSA-3c8v-cfp5-9885
npm	electron	41.0.0	GHSA-3c8v-cfp5-9885

Affected products (as reported)

Vendor	Product	Versions
electron	electron	< 38.8.6>= 39.0.0-alpha.1, < 39.8.1>= 40.0.0-alpha.1, < 40.8.1>= 41.0.0-alpha.1, < 41.0.0

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L

References

https://github.com/electron/electron/security/advisories/GHSA-3c8v-cfp5-9885 x_refsource_CONFIRM