Is CVE-2026-34772 actively exploited?

No active exploitation of CVE-2026-34772 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34772 be exploited remotely?

No. CVE-2026-34772 requires local access to exploit.

What is the CVSS score of CVE-2026-34772?

CVE-2026-34772 has a CVSS score of 5.8 (MEDIUM).

HOME VULNERABILITIESCVE-2026-34772

MEDIUM

CVE-2026-34772

CWE-416Published: April 4, 2026· Updated: Apr 7, 2026

5.8

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:3.4th

Official Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption. Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.

NVD Source

Technical Analysis

CVE-2026-34772 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.8.

From a weakness classification perspective (CWE-416): Use-after-free vulnerabilities involve accessing memory after it has been freed, often enabling arbitrary code execution.