CVE-2026-34776— Electron 缓冲区错误漏洞

Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L

跨界内存读

Electron 缓冲区错误漏洞

Electron是Electron开源的一个用户编写跨平台桌面应用的 JavaScript 框架。该框架基于 nodejs 和 Chromium 可以使用HTML，CSS实现跨平台桌面应用的编写。 Electron 38.8.6之前版本、39.8.1之前版本、40.8.1之前版本和41.0.0之前版本存在缓冲区错误漏洞，该漏洞源于在macOS和Linux上调用app.requestSingleInstanceLock时解析特制的第二个实例消息存在越界堆读取问题，可能导致内存泄露。

N/A

N/A