Apple CVE-2026-34776

CVSS 5.3 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L indicates local attack vector requiring low privileges and high complexity, with high confidentiality impact but no integrity impact and low availability impact. The exploitation requires the attacker to run code as the same user as the Electron app, significantly limiting real-world attack surface compared to remote vulnerabilities. EPSS probability and KEV status are not provided in the input, so we cannot assess active exploitation; however, the lack of any public exploit code, combined with the prerequisite that applications must explicitly call requestSingleInstanceLock() and the local same-user requirement, suggests this is a moderate-priority vulnerability with limited real-world exploitability. The high-complexity attack vector (AC:H) further reduces immediate threat, though applications handling sensitive data in memory should prioritize patching. This is a real security concern but not a critical priority for most users due to privilege and complexity requirements.

A local attacker with user-level access on a macOS or Linux system running an Electron application that calls requestSingleInstanceLock() crafts a second-instance message with malformed data designed to read beyond heap boundaries. When the running Electron app receives this message, the out-of-bounds read exposes sensitive data from adjacent heap memory (such as cryptographic keys, session tokens, or user data) which is delivered to the application's second-instance event handler, where the attacker can retrieve it if they control the delivery mechanism. This attack requires the attacker to operate in the same user context and construct a non-trivial malformed message, placing it in the category of low-probability but high-impact local vulnerabilities; no public proof-of-concept is currently known.