Electron’s off-screen rendering routine receives geometry data from the GPU process, but the main process does not fully validate the shared-memory layout. When the geometry specification exceeds the actual buffer size, the main process reads beyond the intended memory region while assembling paint events, potentially revealing sensitive information or causing the application to crash. The weakness is a classic out-of-bounds read (CWE‑125).

All Electron releases prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3 are affected. These versions are used in desktop applications built with the Electron framework and run on Windows, macOS, and Linux.

The CVSS score of 3.9 indicates low overall severity, and no EPSS data or CISA KEV listing is available. Based on the description, it is inferred that an attacker would need to control or subvert the GPU process – a scenario typically involving local privilege escalation or a compromised graphics driver – to provide malicious geometry data. The vulnerability does not appear exploitable from a remote network context and is not currently tracked in the KEV catalog.