CVE-2026-34764 Details
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Under certain conditions, the release() callback provided on a paint event texture can outlive its backing native state, and invoking it after that point dereferences freed memory in the main process, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering with webPreferences.offscreen: { useSharedTexture: true }. Apps that do not enable shared-texture offscreen rendering are not affected. To mitigate this issue, ensure texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.
A use-after-free vulnerability has been identified in Electron applications that use offscreen rendering with GPU shared textures. This issue affects Electron versions 33.0.0-alpha.1 prior to 39.8.5, as well as versions 40.0.0-alpha.1 prior to 40.8.5, 41.0.0-alpha.1 prior to 41.1.0, and 42.0.0-alpha.1 prior to 42.0.0-alpha.5. The vulnerability arises when the release() callback for a paint event texture outlives its associated native state, leading to dereferencing of freed memory in the main process. This can cause crashes or memory corruption. Applications not using shared-texture offscreen rendering are not affected.
To address this vulnerability, ensure that texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable. The vulnerability has been fixed in Electron versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/electron/electron/security/advisories/GHSA-8x5q-pvf5-64mp | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| electronjs electron | >= 33.0.0, < 39.8.5 >= 40.0.0, < 40.8.5 >= 41.0.0, < 41.1.0 42.0.0 alpha1 42.0.0 alpha2 42.0.0 alpha3 42.0.0 alpha4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |