CVE-2026-70598
Received Received - Intake

Memory Corruption in Electron Framework

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. This issue is fixed in 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-25
AI Q&A
2026-08-05
EPSS Evaluated
2026-08-24
NVD
CVE-2026-70598
EUVD
EUVD-2026-53420

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
electron electron to 39.8.10 (exc)
electron electron to 40.9.0 (exc)
electron electron to 41.2.1 (exc)
electron electron to 42.0.0-beta.3 (exc)
electron electron to 39.8.10|end_excluding=40.9.0|end_excluding=41.2.1|end_excluding=42.0.0-beta.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Electron, a framework for building desktop apps with JavaScript, HTML, and CSS. It involves improper validation of frame data from the GPU process in versions before 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3. A compromised GPU process could cause the main process to read out-of-bounds memory while creating paint event images, potentially exposing sensitive data or crashing the app.

Detection Guidance

To detect this vulnerability, check if your Electron application uses off-screen rendering by verifying the `webPreferences.offscreen` setting in your app's configuration. If enabled, inspect the Electron version against the patched versions (39.8.10, 40.9.0, 41.2.1, or 42.0.0-beta.3). Use commands like `electron --version` to check the version.

Impact Analysis

If you use an affected Electron version with off-screen rendering enabled, a compromised GPU process could expose sensitive memory or crash your application. Only apps using off-screen rendering (via webPreferences.offscreen) are affected. Others remain safe.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory disclosure or application crashes in Electron-based applications using off-screen rendering. A compromised GPU process might expose sensitive memory, which could include personal data regulated under GDPR or protected health information under HIPAA. However, the vulnerability requires prior code execution in the GPU process, limiting its real-world exploitability.

Mitigation Strategies

Immediately update Electron to a patched version (39.8.10, 40.9.0, 41.2.1, or 42.0.0-beta.3). If using off-screen rendering, disable it via `webPreferences.offscreen: false` if not required. Monitor for crashes or memory leaks in applications using Electron.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70598. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart