CVE-2026-34781: low-severity vulnerability in electron
Electron crashes in clipboard.readImage() on malformed clipboard image data
Published · Updated
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.8epss 0.1%
exploitation probability
0.1%top 97% of all CVEs
observed exploitation
nono source reports it
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that call clipboard.readImage() may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process. Apps are only affected if they call clipboard.readImage(). Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Affected products
electron · electronRelated CVEs — electron
In the same product, most dangerous first.
CVE-2020-26272MEDIUMElectron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFsEPSS 1.7%CVE-2020-15174HIGHUnpreventable top-level navigation in ElectronEPSS 1.3%CVE-2020-4075MEDIUMArbitrary file read via window-open IPC in ElectronEPSS 1.2%CVE-2021-39184MEDIUMSandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage APIEPSS 1.1%CVE-2022-29247LOWExposure of Resource to Wrong Sphere in ElectronEPSS 1.0%CVE-2020-4077HIGHContext isolation bypass via contextBridge in ElectronEPSS 1.0%