What is the CVSS score of CVE-2026-34781?

CVE-2026-34781 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34781?

Yes, a patch is available for CVE-2026-34781. Update the affected software to the latest version immediately.

CVE-2026-34781

EUVD-2026-19950 LOW

NULL Pointer Dereference (CWE-476)

2026-04-07 https://github.com/electron/electron

GHSA-f37v-82c4-4x64

RCE Buffer Overflow Denial Of Service Null Pointer Dereference

3.3

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-476 OWASP Top 10:2025 A10:2025 - Mishandling of Exceptional Conditions ASVS 5.0 V16 - Security Logging and Error Handling Null pointer safety, defensive checks MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS 2.8 score (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) reflects a low-severity vulnerability with multiple limiting factors. Attack vector is local-only (AV:L), requiring direct system access; attack complexity is low (AC:L), meaning exploitation is straightforward; privilege requirement is low (PR:L), but user interaction is required (UI:R), necessitating active user involvement. The impact is restricted to availability (A:L) with no confidentiality or integrity risk-confirming the vendor's statement that code execution and memory corruption are impossible. No public exploit code, EPSS data, or CISA KEV status is indicated, and exploitation requires a specific triggering condition (malformed clipboard image data coinciding with a clipboard.readImage() call). While the attack is reliable once triggered, the practical exploitation probability is low due to the requirement for local access, user interaction, and the attacker's inability to remotely populate the clipboard. This is a genuine but low-priority vulnerability suitable for routine patching cycles rather than emergency response.
Exploit ScenarioDerived	A local attacker with system access crafts a malformed image file and places it on the system clipboard using standard clipboard mechanisms. When a vulnerable Electron application calls clipboard.readImage() as part of its normal operation (e.g., paste functionality in an image editor), the malformed data fails to decode, resulting in a null bitmap that is dereferenced without validation. This triggers a controlled abort that crashes the application process, achieving denial of service. The attack requires user interaction in the sense that the clipboard must be populated at the moment clipboard.readImage() is called, but does not require the user's awareness or explicit approval of the malicious action.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 07, 2026

Denial of service in Electron's clipboard.readImage() allows local authenticated attackers to crash applications by supplying malformed image data on the system clipboard. The vulnerability affects Electron versions prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, but only impacts apps that explicitly call clipboard.readImage(). No code execution or memory corruption is possible; the attack results in a controlled process abort when a null bitmap is passed unchecked to image construction. Vendor-released patches are available across all supported release lines.

RemediationAI

Vendor-released patches are available: upgrade to Electron 39.8.5, 40.8.5, 41.1.0, or 42.0.0-alpha.5 or later depending on your current release line. The patch addresses null pointer validation in the clipboard.readImage() method via https://github.com/electron/electron/pull/50475 and commit a48f03fb8d03933547281ddb2dbb6c6b9e705287. As a temporary workaround for unpatched versions, call clipboard.availableFormats() to validate clipboard contents before invoking clipboard.readImage(), though this only reduces the attack window and does not eliminate the vulnerability. Applications that do not call clipboard.readImage() are not affected and do not require patching for this specific issue. Consult the full security advisory at https://github.com/electron/electron/security/advisories/GHSA-f37v-82c4-4x64 for additional guidance.

Affected VersionsENISA

electron 40.0.0-alpha.1, < 40.8.5

electron 41.0.0-alpha.1, < 41.1.0

electron < 39.8.5

electron 42.0.0-alpha.1, < 42.0.0-alpha.5

Affected Packages

npm electron fix: 39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5

euvd electron_40_0_0_alpha_1 fix: 40.8.5

euvd electron_41_0_0_alpha_1 fix: 41.1.0

euvd electron_42_0_0_alpha_1 fix: 42.0.0-alpha.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in npm, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Electron is a framework for building cross-platform desktop applications using web technologies. The vulnerability exists in the clipboard API's readImage() method (CPE: pkg:npm/electron), which interfaces with the system clipboard to retrieve image data. The root cause is a null pointer dereference (CWE-476) where the method fails to validate that clipboard image data successfully decoded before passing the resulting bitmap to image construction routines. When the system clipboard contains image data in a format or state that causes decoding to fail, a null pointer is created and dereferenced without validation, triggering a controlled abort that terminates the process. The vulnerability requires local system access and user interaction (the clipboard must be actively populated with malformed image data), limiting the attack surface to local threat actors.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

CVSS changed

Jul 24, 2026 - 22:23 NVD

2.8 (LOW) 3.3 (LOW)

Patch released

Apr 07, 2026 - 16:00 nvd

Patch available

CVE Published

Apr 07, 2026 - 15:52 nvd

LOW 2.8

DescriptionNVD

Impact

Apps that call clipboard.readImage() may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process.

Apps are only affected if they call clipboard.readImage(). Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution.

Workarounds

Validate that the clipboard contains image data via clipboard.availableFormats() before calling clipboard.readImage(). Note this only narrows the window - upgrading to a fixed version is recommended.

Fixed Versions

42.0.0-alpha.5
41.1.0
40.8.5
39.8.5

For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Threat Intel

1 source

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact· derived

Low

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +16

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.