This vulnerability is a use‑after‑free in Electron’s handling of offscreen GPU shared textures. When the release() callback on a paint event texture is invoked after the associated native backing has been freed, the main process dereferences invalid memory. The result can be a crash or more severe memory corruption that may be exploitable for code execution in some contexts, although the advisory does not confirm direct remote code execution.

The issue affects Electron applications that enable offscreen rendering with shared textures. Versions from 33.0.0‑alpha.1 up to, but not including, 39.8.5, 40.8.5, 41.1.0, and 42.0.0‑alpha.5 are vulnerable when webPreferences.offscreen.useSharedTexture is true. Applications that do not use shared‑texture offscreen rendering are not affected. The problem is specific to the Electron framework, not to end users’ operating systems or browsers.

The CVSS score of 2.3 indicates a low severity, and the EPSS score is not available. Because the flaw requires the application to employ offscreen rendering with shared textures, the likelihood of exploitation in the wild is limited. Attackers would need to trigger the release() callback after the texture’s native state has been freed, which is dependent on the app’s rendering logic. The vulnerability is not listed in the CISA KEV catalog, further suggesting that widespread exploitation has not been observed. The primary consequence is a crash or memory corruption, which may be leveraged for more advanced attacks if combined with other weaknesses.