Is CVE-2026-70598 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70598 being exploited in the wild.

How severe is CVE-2026-70598?

Low severity, with a CVSS score of 3.9, published 5 August 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=0,fixed=39.8.10.

Is there a fix for CVE-2026-70598?

Yes. electron (npm): upgrade to 39.8.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-70598 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-70598?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70598: Electron out-of-bounds read in off-screen rendering

CVE-2026-70598 · Severity: low · CVSS 3.9 · Published 2026-08-05

Electron is a framework used to build desktop applications using web technologies. A vulnerability in its off-screen rendering mode could allow a compromised sub-process to access sensitive information from the main application's memory or cause the application to crash. This issue only affects applications specifically configured to use off-screen rendering and requires an attacker to have already compromised the GPU process.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-70598 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70598 being exploited in the wild.
How severe is CVE-2026-70598?: Low severity, with a CVSS score of 3.9, published 5 August 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=0,fixed=39.8.10.
Is there a fix for CVE-2026-70598?: Yes. electron (npm): upgrade to 39.8.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70598 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-70598?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 39.8.10 or later
```
npm install electron@39.8.10
```

Technical details

An out-of-bounds read vulnerability (CWE-125) exists in Electron's off-screen rendering (OSR) implementation. The main process fails to fully validate frame geometry and data received from the GPU process against the actual size of the shared-memory mapping. An attacker who has already achieved code execution within the GPU process can provide malicious geometry data, forcing the main process to read beyond buffer boundaries during 'paint' event image production. This can lead to the disclosure of sensitive memory contents or an application crash. The vulnerability is fixed in versions 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.

Affected products

Electron Electron < 39.8.10, >= 40.0.0-alpha.1, < 40.9.0, >= 41.0.0-alpha.1, < 41.2.1, >= 42.0.0-alpha.1, < 42.0.0-beta.3

Identifiers

CVE-2026-70598
GHSA-pfmc-3mgc-p6fp

Timeline

2026-07-27: disclosed
2026-08-05: advisory
2026-08-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.