Electron applications that register for powerMonitor events are vulnerable to a use-after-free flaw (CWE‑416). The bug occurs when the native PowerMonitor object is garbage‑collected while the OS‑level resources it created—such as a Windows message window or a macOS shutdown handler—retain dangling references. A subsequent session‑change event on Windows or system shutdown on macOS dereferences freed memory, potentially causing a crash or memory corruption.

The vulnerability affects Electron releases prior to 38.8.6, 39.8.1, 40.8.0, and 41.0.0‑beta.8. All desktop applications built with the Electron framework that consume powerMonitor events—suspend, resume, lock‑screen, etc.—are potentially impacted. The defect resides in Electron’s core and is present on both Windows and macOS platforms.

The CVSS score of 7.0 indicates high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, implying no publicly documented exploits. Based on the description, it is inferred that the likely attack vector involves triggering a system session‑change event or a shutdown, which typically would require local or privileged access. Therefore, while the impact of a crash or memory corruption could be significant, the likelihood of exploitation is limited to environments where an attacker can manipulate these OS‑level events.