Is CVE-2026-34764 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34764 being exploited in the wild.

How severe is CVE-2026-34764?

Low severity, with a CVSS score of 3.1, published 3 April 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=33.0.0-alpha.1,fixed=39.8.5.

Is there a fix for CVE-2026-34764?

Yes. electron (npm): upgrade to 39.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34764 attacked?

It is attacked with local access.

Am I affected by CVE-2026-34764?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34764: Electron use-after-free in offscreen shared texture release() callback

CVE-2026-34764 · Severity: low · CVSS 3.1 · Published 2026-04-03

Electron is a framework used to build desktop applications with web technologies. Applications using offscreen GPU rendering with shared textures can crash or suffer memory corruption if a release callback is invoked after the underlying memory has been freed. Only apps explicitly enabling shared-texture offscreen rendering are affected.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-34764 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34764 being exploited in the wild.
How severe is CVE-2026-34764?: Low severity, with a CVSS score of 3.1, published 3 April 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=33.0.0-alpha.1,fixed=39.8.5.
Is there a fix for CVE-2026-34764?: Yes. electron (npm): upgrade to 39.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34764 attacked?: It is attacked with local access.
Am I affected by CVE-2026-34764?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 39.8.5 or later
```
npm install electron@39.8.5
```

Technical details

A use-after-free vulnerability (CWE-416) exists in Electron's offscreen rendering implementation with GPU shared textures. The release() callback provided on a paint event texture can outlive its backing native state; invoking the callback after memory has been freed dereferences freed memory in the main process, potentially causing a crash or memory corruption. The vulnerability only affects applications that enable offscreen rendering with webPreferences.offscreen: { useSharedTexture: true }. Exploitation requires high privileges and local access. Patches are available in versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5 or later.

Affected products

OpenJS Foundation Electron 33.0.0-alpha.1 to 39.8.4, 40.0.0-alpha.1 to 40.8.4, 41.0.0-alpha.1 to 41.0.x, 42.0.0-alpha.1 to 42.0.0-alpha.4

Identifiers

CVE-2026-34764
GHSA-8x5q-pvf5-64mp

Timeline

2026-04-03: disclosed: Advisory published
2026-04-03: patched: Fixed in versions 39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5

References

https://github.com/electron/electron/security/advisories/GHSA-8x5q-pvf5-64mp

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.