CVE-2026-114122

🎯 CVE-2026-114122 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-114122 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could supply inconsistent frame geometry and cause the main process to read out-of-bounds memory w

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could supply inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing captured frame images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.

Klassifikation & Betroffenheit:

CWE-125 electron electron 45.0.0-alpha.1, < 45.0.0-alpha.9electron 43.0.0-alpha.1, < 43.7.3electron 44.0.0-alpha.1, < 44.4.3electron < 42.11.6

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

🛡️ Empfohlene Mitigation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all …

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-540 · Overread Buffers (High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-114121 5.4 CVE-2026-113800 5.4 CVE-2026-113798 5.4 CVE-2026-70612 5.4 CVE-2026-70610 5.4

🩹 Patch verfügbar (OSV):

🩹 4c6c28d5e0c4f60a80e4076b8c75767b1c3c4119 (Commit) 🩹 79de330422c91960492053e3e7d894911eddb55a (Commit)

📰 Eigene Berichterstattung: ➔ CVE-2026-114122 | Electron up to 42.11.5/43.7.2/44.4.2/45.0.0-alpha.8 GPU Proces

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 10/2026

Heute 29.10.

CVSS-Vektor-Analyse: 3.9

AV · Angriffsvektor Lokal

AC · Komplexität Hoch

PR · Privilegien Hoch

UI · Interaktion Keine

S · Scope Verändert

C · Vertraulichkeit Gering

I · Integrität Keine

A · Verfügbarkeit Gering

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

CNA-Bewertung (GitHub_M): 3.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

Veröffentlicht:21.10.2026

Aktualisiert:28.10.2026 02:17

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2026-107362

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-125 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	741	0,2 %
≥50 %	3.215	0,8 %
≥10 %	22.047	5,8 %
<10 %	354.726	93,2 %

3.9 LOW

EPSS

0.2%

CVE-2026-114122 💻 Lokal 🔐 Admin-Rechte nötig

electron

CVE-2026-114122 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could supply inconsistent frame geometry and cause the main process to read out-of-bounds memory w

CWE-125 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 7 Tagen

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub