CVE-2026-70598

Analyzed Analyzed - Analysis Complete

Memory Corruption in Electron Framework

Publication date: 2026-08-05

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. This issue is fixed in 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-08-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70598

EUVD

EUVD-2026-53420

Affected Vendors & Products

Vendor	Product	Version / Range
electronjs	electron	42.0.0
electronjs	electron	42.0.0
electronjs	electron	42.0.0
electronjs	electron	42.0.0
electronjs	electron	From 40.0.0 (inc) to 40.9.0 (exc)
electronjs	electron	42.0.0
electronjs	electron	42.0.0
electronjs	electron	42.0.0
electronjs	electron	42.0.0
electronjs	electron	to 39.8.10 (exc)
electronjs	electron	From 41.0.0 (inc) to 41.2.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects Electron, a framework for building desktop apps with JavaScript, HTML, and CSS. It involves improper validation of frame data from the GPU process in versions before 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3. A compromised GPU process could cause the main process to read out-of-bounds memory while creating paint event images, potentially exposing sensitive data or crashing the app.

Detection Guidance

To detect this vulnerability, check if your Electron application uses off-screen rendering by verifying the `webPreferences.offscreen` setting in your app's configuration. If enabled, inspect the Electron version against the patched versions (39.8.10, 40.9.0, 41.2.1, or 42.0.0-beta.3). Use commands like `electron --version` to check the version.

Impact Analysis

If you use an affected Electron version with off-screen rendering enabled, a compromised GPU process could expose sensitive memory or crash your application. Only apps using off-screen rendering (via webPreferences.offscreen) are affected. Others remain safe.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory disclosure or application crashes in Electron-based applications using off-screen rendering. A compromised GPU process might expose sensitive memory, which could include personal data regulated under GDPR or protected health information under HIPAA. However, the vulnerability requires prior code execution in the GPU process, limiting its real-world exploitability.

Mitigation Strategies

Immediately update Electron to a patched version (39.8.10, 40.9.0, 41.2.1, or 42.0.0-beta.3). If using off-screen rendering, disable it via `webPreferences.offscreen: false` if not required. Monitor for crashes or memory leaks in applications using Electron.

Hi! I’m here to help you understand CVE-2026-70598. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70