A use‑after‑free occurs when an Electron application that supports downloads programmatically destroys a session while a native file‑save dialog is open. Dismissing the dialog after the session has been torn down dereferences already freed memory, which may cause the application to crash or corrupt memory. If the corrupted memory is exploitable, an attacker could potentially achieve remote code execution. Based on the description, the vulnerable condition requires the attacker to have influence over the application’s session life cycle and trigger a download save dialog.

The Electron framework, versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0‑beta.8 are patched for this issue. Applications built with earlier releases of Electron and that allow downloads and session destruction at runtime are affected. Applications that do not allow downloads or do not destroy sessions at runtime are not impacted.

The CVSS score of 5.8 indicates a medium severity as the vulnerability could lead to denial of service or memory corruption but does not guarantee remote code execution. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is most likely local, requiring the attacker to control the application or influence user actions. Overall, the risk is moderate, mitigated further by the low exploitation probability.