Electron versions prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5 can crash when an application calls clipboard.readImage() with malformed image data from the system clipboard. The null bitmap that results from decoding failure is passed unchecked to image construction, triggering a controlled abort that terminates the Electron process. The crash provides a denial of service for the affected application but does not allow memory corruption or arbitrary code execution.

The vulnerability affects the Electron framework for desktop applications. All Electron releases older than 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5 are impacted, but only applications that invoke clipboard.readImage() are at risk.

With a CVSS score of 2.8 the severity is low, and no EPSS data or KEV listing is available. The likely attack vector is local: an attacker can place specially crafted image data on the clipboard through user interaction or malicious input to cause a crash. Exploitation requires the application to read the clipboard image; otherwise the issue is irrelevant.