# CVE-2026-34781: Electron denial of service in clipboard.readImage

Source: https://junglewise.ai/threats/cve-2026-34781-electron-denial-of-service-in-clipboard-readimage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-34781 · Severity: low · CVSS 3.1 · Published 2026-04-07

Electron is a popular framework used to build desktop applications like Slack, Discord, and VS Code. A flaw in how these applications handle images copied to the system clipboard can cause the application to crash unexpectedly. This results in a denial of service for the user but does not risk the theft of sensitive data or unauthorized access to the system.

Technologies: [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-34781 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34781 being exploited in the wild.

**How severe is CVE-2026-34781?** Low severity, with a CVSS score of 3.1, published 7 April 2026.

**Which products and versions are affected?** electron (npm) SEMVER:introduced=0,fixed=39.8.5.

**Is there a fix for CVE-2026-34781?** Yes. electron (npm): upgrade to 39.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34781 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-34781?** Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 39.8.5 or later

  ```sh
  npm install electron@39.8.5
  ```


## Technical details

A NULL pointer dereference (CWE-476) exists in Electron's clipboard handling logic. When an application calls the `clipboard.readImage()` method and the system clipboard contains image data that fails to decode, the underlying C++ code receives a null bitmap. This null value is passed unchecked to the image construction routine, triggering a controlled abort that crashes the process. The vulnerability is limited to a denial of service; it does not allow for memory corruption or arbitrary code execution. Exploitation requires a user to have malformed data in their clipboard and then interact with an application feature that triggers the image read. The issue is resolved in versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.

## Affected products

- ElectronJS Electron < 39.8.5, >= 40.0.0-alpha.1 < 40.8.5, >= 41.0.0-alpha.1 < 41.1.0, >= 42.0.0-alpha.1 < 42.0.0-alpha.5

## Identifiers

- CVE-2026-34781
- GHSA-f37v-82c4-4x64

## Timeline

- 2026-04-06: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed: CVE-2026-34781 published

## References

- [https://github.com/electron/electron/security/advisories/GHSA-f37v-82c4-4x64](https://github.com/electron/electron/security/advisories/GHSA-f37v-82c4-4x64)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)