CVE-2026-114122

Undergoing Analysis Undergoing Analysis - In Progress

Memory Corruption in Electron Framework

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could supply inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing captured frame images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114122

EUVD

EUVD-2026-107362

Affected Vendors & Products

Vendor	Product	Version / Range
electron	electron	< 42.11.6
electron	electron	>= 43.0.0-alpha.1, < 43.7.3
electron	electron	>= 44.0.0-alpha.1, < 44.4.3
electron	electron	>= 45.0.0-alpha.1, < 45.0.0-alpha.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in Electron allows a compromised GPU process to supply malformed frame data to the main process via webContents.beginFrameSubscription. The main process fails to fully validate the frame geometry, leading to out-of-bounds memory reads while capturing frame images. This could disclose sensitive memory contents or crash the application. The issue affects versions before 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.

Detection Guidance

This vulnerability affects applications using webContents.beginFrameSubscription. Detection involves checking Electron version and inspecting applications for frame subscription usage. No direct network detection commands are provided in the context. Check Electron version with: electron --version or npm list electron. Review application code for beginFrameSubscription calls.

Impact Analysis

If exploited, this vulnerability could allow an attacker with code execution in the GPU process to read sensitive memory from the main process or crash the application. This may lead to information disclosure or denial of service. Only applications using webContents.beginFrameSubscription are affected, and only if the GPU process is already compromised.

Compliance Impact

The vulnerability could potentially impact compliance with GDPR and HIPAA by enabling out-of-bounds memory reads, which may lead to unauthorized disclosure of sensitive data. If an attacker exploits this flaw, they could access memory containing personal or health information, violating confidentiality requirements under these regulations.

Mitigation Strategies

Update Electron to patched versions: 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9. If using affected versions, avoid applications using webContents.beginFrameSubscription until updated. No workarounds exist; updating is required.

Hi! I’m here to help you understand CVE-2026-114122. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...