CVE-2026-34776
Out-of-Bounds Heap Read in Electron app.requestSingleInstanceLock
Publication date: 2026-04-04
Last updated on: 2026-04-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | to 38.8.6 (exc) |
| electronjs | electron | From 39.0.0 (inc) to 39.8.1 (exc) |
| electronjs | electron | From 40.0.0 (inc) to 40.8.1 (exc) |
| electronjs | electron | 41.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Electron allows an out-of-bounds heap read that can leak memory contents to the application's second-instance event handler. This leakage can potentially expose sensitive information, which may impact the confidentiality of data handled by applications using affected Electron versions.
Since regulations like GDPR and HIPAA emphasize the protection of sensitive and personal data, this vulnerability could lead to non-compliance if exploited, due to unauthorized disclosure of confidential information.
Remediation requires updating to patched Electron versions to prevent potential data leaks and maintain compliance with such standards.
Can you explain this vulnerability to me?
CVE-2026-34776 is an out-of-bounds heap read vulnerability in the Electron framework on macOS and Linux platforms. It occurs when applications use the app.requestSingleInstanceLock() API and a crafted second-instance message is parsed. This causes the Electron process to read beyond the allocated heap buffer, leaking memory.
The leaked memory can be exposed to the application's second-instance event handler, potentially disclosing sensitive information. This issue only affects processes running under the same user account as the Electron app and does not affect Windows platforms. Applications not using app.requestSingleInstanceLock() are not vulnerable.
How can this vulnerability impact me? :
This vulnerability can lead to the leakage of sensitive memory contents to the application's second-instance event handler. Although exploitation requires local access and some complexity, it can result in significant confidentiality breaches.
- Memory leakage of sensitive information
- Potential exposure of confidential data within the Electron app
- Limited to processes running as the same user, so risk is confined to local users with access
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no known application-level workarounds or specific detection commands provided for this vulnerability. Detection would generally involve identifying if an Electron application on macOS or Linux is running a vulnerable version and is using the app.requestSingleInstanceLock() API.
Since the vulnerability is triggered by crafted second-instance messages and is limited to local processes running under the same user, network-based detection is unlikely to be effective.
A practical approach to detection is to check the Electron version used by your applications and verify if it is prior to the patched versions (38.8.6, 39.8.1, 40.8.1, 41.0.0).
- Use commands like `electron --version` or check package.json dependencies to identify Electron versions.
- Inspect application code or runtime behavior to confirm usage of `app.requestSingleInstanceLock()`.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to update Electron to one of the patched versions: 38.8.6, 39.8.1, 40.8.1, or 41.0.0.
Applications that do not call `app.requestSingleInstanceLock()` are not affected, so reviewing and potentially disabling this API usage can also mitigate risk.
Since the vulnerability requires local access and affects only processes running as the same user, restricting local access and user permissions can reduce exposure.