CVE-2026-114124

Undergoing Analysis Undergoing Analysis - In Progress

Memory Corruption in Electron Framework

Publication date: 2026-10-21

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could provide inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114124

EUVD

EUVD-2026-107392

Affected Vendors & Products

Vendor	Product	Version / Range
electron	electron	< 42.11.6
electron	electron	>= 43.0.0-alpha.1, < 43.7.3
electron	electron	>= 44.0.0-alpha.1, < 44.4.3
electron	electron	>= 45.0.0-alpha.1, < 45.0.0-alpha.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects Electron applications using off-screen rendering on macOS. A compromised GPU process could send invalid frame geometry data to the main process, causing it to read out-of-bounds memory while generating paint event images. This could expose sensitive memory contents or crash the application. The issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.

Detection Guidance

This vulnerability only affects applications using off-screen rendering on macOS with the webPreferences.offscreen flag enabled. Detection involves checking Electron version and application configuration. Use 'electron --version' to verify version. If using off-screen rendering, inspect application code for webPreferences.offscreen=true. No direct network detection commands are applicable.

Impact Analysis

If you use an affected Electron version with off-screen rendering enabled on macOS, an attacker with code execution in the GPU process could read sensitive memory or crash your application. This requires the attacker to already have control of the GPU process, limiting the attack surface.

Mitigation Strategies

Update Electron to version 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9 or later. If using off-screen rendering on macOS, disable it by removing webPreferences.offscreen=true until patched. No other workarounds exist according to official advisories.

Hi! I’m here to help you understand CVE-2026-114124. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...