Applications built with Electron that call app.requestSingleInstanceLock() on macOS or Linux can be tricked into reading memory beyond a buffer when processing a forged second-instance message. The flaw, a classic out-of-bounds heap read identified as CWE‑125, allows the attacker to acquire parts of the application's memory during the event handler and could expose sensitive data such as credentials or configuration files. The impact is the loss of confidentiality for information held by the victim process.

Electron framework releases earlier than 38.8.6, 39.8.1, 40.8.1, or 41.0.0 on macOS and Linux are affected. Windows is exempt from this issue. Only applications that explicitly use app.requestSingleInstanceLock() are vulnerable; those that omit this call remain immune.

The CVSS score of 5.3 indicates moderate severity. Exploitation is local to the user who owns the Electron process and requires sending a crafted second‑instance IPC message. The attack vector is inferred from the description; no remote exploitation is reported. The vulnerability is not listed in the CISA KEV catalog, but a local attacker can potentially gain confidential information, representing a moderate to high risk in environments where applications handle sensitive data.