{"id":"EUVD-2026-53420","enisaUuid":"58ed9f53-0485-38bb-a053-0be987f91e0a","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. This issue is fixed in 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.","datePublished":"Aug 5, 2026, 3:27:24 PM","dateUpdated":"Aug 5, 2026, 6:15:50 PM","baseScore":3.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","references":"https://github.com/electron/electron/security/advisories/GHSA-pfmc-3mgc-p6fp\nhttps://github.com/electron/electron/commit/2c24640e7b0b9c74fe9f44bce0fde138340ff4fb\n","aliases":"CVE-2026-70598\nGHSA-pfmc-3mgc-p6fp\n","assigner":"GitHub_M","epss":0.14,"enisaIdProduct":[{"id":"04bc0b3b-9dbb-3618-8f00-13aac1ff77e7","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"41.0.0-alpha.1, \u003c 41.2.1"},{"id":"0cd74b7d-9f70-3199-af0b-df82bb9f4e81","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 39.8.10"},{"id":"24ba979d-f5ea-3723-827a-f68576616eca","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.0.0-alpha.1, \u003c 42.0.0-beta.3"},{"id":"78f72c9f-9c86-32fa-b823-d240fd1d3b39","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"40.0.0-alpha.1, \u003c 40.9.0"}],"enisaIdVendor":[{"id":"b3123376-b9e8-3cf0-a5a4-1f6860659615","vendor":{"name":"electron"}}],"enisaIdVulnerability":[{"id":"3320a590-9fed-3dc8-8dc5-21a90d32911f","vulnerability":{"id":"GHSA-pfmc-3mgc-p6fp","description":"Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size","datePublished":"Aug 5, 2026, 3:27:27 PM","dateUpdated":"Aug 5, 2026, 3:27:27 PM","baseScore":0.0,"references":"https://github.com/electron/electron/security/advisories/GHSA-pfmc-3mgc-p6fp\nhttps://github.com/electron/electron/commit/2c24640e7b0b9c74fe9f44bce0fde138340ff4fb\nhttps://github.com/electron/electron\n","enisa_id":"EUVD-2026-53420\n","aliases":"GHSA-pfmc-3mgc-p6fp\nCVE-2026-70598\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:06 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"49f2678d-22b7-38a2-89e9-6ff3478afd3a","vulnerability":{"id":"CVE-2026-70598","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. This issue is fixed in 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.","datePublished":"Aug 5, 2026, 3:27:24 PM","dateUpdated":"Aug 5, 2026, 6:15:50 PM","status":"PUBLISHED","baseScore":3.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","references":"https://github.com/electron/electron/security/advisories/GHSA-pfmc-3mgc-p6fp\nhttps://github.com/electron/electron/commit/2c24640e7b0b9c74fe9f44bce0fde138340ff4fb\n","enisa_id":"EUVD-2026-53420\n","assigner":"GitHub_M","epss":0.14,"dataProcessed":"Oct 28, 2026, 7:12:48 AM","vulnerabilityProduct":[{"id":"178184a4-ff68-3470-928e-8f5797fa63d5","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"41.0.0-alpha.1, \u003c 41.2.1"},{"id":"2e238075-4482-3c9d-ac9d-0f69a36f9038","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.0.0-alpha.1, \u003c 42.0.0-beta.3"},{"id":"616a1411-9fe3-3ed7-82e0-697c5442ea8f","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"40.0.0-alpha.1, \u003c 40.9.0"},{"id":"b918acd7-55e5-3c28-97b0-63a056767d6b","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 39.8.10"}],"vulnerabilityVendor":[{"id":"c01b4cff-3254-3d85-b28c-09987a47ad72","vendor":{"name":"electron"}}]}}],"enisaIdAdvisory":[]}