# CVE-2026-34764: Electron use-after-free in offscreen shared texture release() callback

Source: https://junglewise.ai/threats/cve-2026-34764-electron-use-after-free-in-offscreen-shared-texture-release  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-34764 · Severity: low · CVSS 3.1 · Published 2026-04-03

Electron is a framework used to build desktop applications with web technologies. Applications using offscreen GPU rendering with shared textures can crash or suffer memory corruption if a release callback is invoked after the underlying memory has been freed. Only apps explicitly enabling shared-texture offscreen rendering are affected.

Technologies: [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-34764 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34764 being exploited in the wild.

**How severe is CVE-2026-34764?** Low severity, with a CVSS score of 3.1, published 3 April 2026.

**Which products and versions are affected?** electron (npm) SEMVER:introduced=33.0.0-alpha.1,fixed=39.8.5.

**Is there a fix for CVE-2026-34764?** Yes. electron (npm): upgrade to 39.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34764 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-34764?** Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 39.8.5 or later

  ```sh
  npm install electron@39.8.5
  ```


## Technical details

A use-after-free vulnerability (CWE-416) exists in Electron's offscreen rendering implementation with GPU shared textures. The release() callback provided on a paint event texture can outlive its backing native state; invoking the callback after memory has been freed dereferences freed memory in the main process, potentially causing a crash or memory corruption. The vulnerability only affects applications that enable offscreen rendering with webPreferences.offscreen: { useSharedTexture: true }. Exploitation requires high privileges and local access. Patches are available in versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5 or later.

## Affected products

- OpenJS Foundation Electron 33.0.0-alpha.1 to 39.8.4, 40.0.0-alpha.1 to 40.8.4, 41.0.0-alpha.1 to 41.0.x, 42.0.0-alpha.1 to 42.0.0-alpha.4

## Identifiers

- CVE-2026-34764
- GHSA-8x5q-pvf5-64mp

## Timeline

- 2026-04-03: disclosed: Advisory published
- 2026-04-03: patched: Fixed in versions 39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5

## References

- [https://github.com/electron/electron/security/advisories/GHSA-8x5q-pvf5-64mp](https://github.com/electron/electron/security/advisories/GHSA-8x5q-pvf5-64mp)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)