CVE-2026-34776: Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Published Apr 3, 2026

Updated

Impact On macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler.

This issue is limited to processes running as the same user as the Electron app.

Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue.

Workarounds There are no app side workarounds, developers must update to a patched version of Electron.

Fixed Versions 41.0.0 40.8.1 39.8.1 38.8.6

For more information If there are any questions or comments about this advisory, please email security@electronjs.org

Other sources

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.

— MITRE

Affected Software

21 affected componentsFixes available

npm/electron>=41.0.0-alpha.1<41.0.0

41.0.0

npm/electron>=40.0.0-alpha.1<40.8.1

40.8.1

npm/electron>=39.0.0-alpha.1<39.8.1

39.8.1

npm/electron<38.8.6

38.8.6

electronjs Electron Node.js<38.8.6

electronjs Electron Node.js>=39.0.0<39.8.1

electronjs Electron Node.js>=40.0.0<40.8.1

electronjs Electron Node.js=41.0.0-alpha1

electronjs Electron Node.js=41.0.0-alpha2

electronjs Electron Node.js=41.0.0-alpha3

electronjs Electron Node.js=41.0.0-alpha4

electronjs Electron Node.js=41.0.0-alpha5

electronjs Electron Node.js=41.0.0-alpha6

electronjs Electron Node.js=41.0.0-beta1

electronjs Electron Node.js=41.0.0-beta2

electronjs Electron Node.js=41.0.0-beta3

electronjs Electron Node.js=41.0.0-beta4

electronjs Electron Node.js=41.0.0-beta5

electronjs Electron Node.js=41.0.0-beta6

electronjs Electron Node.js=41.0.0-beta7

electronjs Electron Node.js=41.0.0-beta8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 41.0.0
Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 40.8.1
Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 39.8.1
Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 38.8.6
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 38.8.6
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 39.8.1
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 40.8.1
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 41.0.0

Event History

Apr 3, 2026

Advisory Published

via GitHub·02:43 AM

Data Sourced

via GitHub·02:43 AM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·11:56 PM

Data Sourced

via MITRE·11:56 PM

DescriptionSeverityWeakness

Apr 4, 2026

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeaknessAffected Software

CVE-2026-34776: Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Other sources

Affected Software

Remediation

Event History

Don't miss critical vulnerabilities

Company

Resources

Contact