Executive brief
Electron is a popular framework used to build desktop applications like Slack, Discord, and VS Code. A flaw in how these applications handle images copied to the system clipboard can cause the application to crash unexpectedly. This results in a denial of service for the user but does not risk the theft of sensitive data or unauthorized access to the system.
Technical details
A NULL pointer dereference (CWE-476) exists in Electron's clipboard handling logic. When an application calls the `clipboard.readImage()` method and the system clipboard contains image data that fails to decode, the underlying C++ code receives a null bitmap. This null value is passed unchecked to the image construction routine, triggering a controlled abort that crashes the process. The vulnerability is limited to a denial of service; it does not allow for memory corruption or arbitrary code execution. Exploitation requires a user to have malformed data in their clipboard and then interact with an application feature that triggers the image read. The issue is resolved in versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.
Affected products
- ElectronJS Electron < 39.8.5, >= 40.0.0-alpha.1 < 40.8.5, >= 41.0.0-alpha.1 < 41.1.0, >= 42.0.0-alpha.1 < 42.0.0-alpha.5
Timeline
- 2026-04-06: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed: CVE-2026-34781 published