{"id":"CVE-2026-114124","kind":"vulnerability","aliases":["CVE-2026-114124","GHSA-h3v5-h239-pg29"],"related":[],"title":"Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry","description":"### Impact\nIn offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing `paint` event images, disclosing memory or crashing the app. GHSA-pfmc-3mgc-p6fp covers the same issue on the other capture paths.\n\nApps are only affected if they use offscreen rendering (`webPreferences.offscreen`) on macOS and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.\n\n### Workarounds\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n* `45.0.0-alpha.9`\n* `44.4.3`\n* `43.7.3`\n* `42.11.6`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","summary":"Electron's main process does not fully validate frame geometry supplied by the GPU process when offscreen rendering is used on macOS. An attacker who already has code execution in the GPU process can make the app read out-of-bounds memory, leaking data or crashing it.","severity":"low","cvss":3.9000000953674316,"epss":0.001509999972768128,"exploited":false,"exploited_at":null,"products":[{"name":"electron","fixed":["42.11.6"],"affected":"< 42.11.6","ecosystem":"npm"},{"name":"electron","fixed":["43.7.3"],"affected":">= 43.0.0-alpha.1, < 43.7.3","ecosystem":"npm"},{"name":"electron","fixed":["44.4.3"],"affected":">= 44.0.0-alpha.1, < 44.4.3","ecosystem":"npm"},{"name":"electron","fixed":["45.0.0-alpha.9"],"affected":">= 45.0.0-alpha.1, < 45.0.0-alpha.9","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-125","electron","macos","offscreen-rendering","runtime"],"not_affected_if":["already-patched-version","no-offscreen-rendering","non-macos"],"how_to_check":"Search the app for webPreferences.offscreen or offscreen: true and confirm it runs on macOS.\nCheck the installed version with npm ls electron.","fix":"Upgrade electron to 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9 depending on your release line; no app-side workaround exists.","status":"open","published_at":"2026-10-21T18:17:24+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:03:28+00:00","updated_at":"2026-10-23T21:57:29+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T20:03:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade electron to 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9 depending on your release line; no app-side workaround exists.\nunknown","summary":"Electron's main process does not fully validate frame geometry supplied by the GPU process when offscreen rendering is used on macOS. An attacker who already has code execution in the GPU process can make the app read out-of-bounds memory, leaking data or crashing it.","category":"runtime","who_cares":["electron","macos","offscreen-rendering"],"confidence":0.8,"analyst_note":"","how_to_check":"Search the app for webPreferences.offscreen or offscreen: true and confirm it runs on macOS.\nCheck the installed version with npm ls electron.\nunknown","needs_analyst":false,"not_affected_if":["no-offscreen-rendering","non-macos","already-patched-version"],"severity_if_unknown":"low"},"cost_usd":0.000406,"input_tokens":2425,"output_tokens":327,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-114124':16A,24A '-125':30B '-2026':15A,23A '3mgc':136C '42.11.6':203C '43.7.3':202C '44.4.3':201C '45.0.0':199C 'advisori':216C 'affect':150C,180C 'alpha.9':200C 'alreadi':62B 'app':73B,132C,147C,171C,185C 'attack':60B,161C 'bound':78B,120C 'captur':145C 'caus':111C 'code':64B,165C 'comment':213C 'compromis':107C 'could':110C 'cover':138C 'crash':83B,130C 'cve':14A,22A 'cwe':29B 'data':81B,92C 'disclos':127C 'electron':1A,25A,26A,27A,28A,31B,37B,196C 'email':217C 'event':125C 'execut':65B,166C 'fix':197C 'frame':12A,45B,91C 'fulli':43B,100C 'gain':164C 'geometri':13A,46B 'ghsa':18A,134C 'ghsa-h3v5-h239-pg29':17A 'ghsa-pfmc-3mgc-p6fp':133C 'gpu':10A,50B,68B,96C,108C,169C 'gpu-suppli':9A 'h239':20A 'h3v5':19A 'imag':126C 'impact':84C 'inform':206C 'issu':141C 'leak':80B 'maco':7A,32B,58B,90C,158C 'mailto':221C 'main':39B,104C,113C 'make':71B 'memori':79B,121C,128C 'mode':88C 'must':189C 'off-screen':2A 'offscreen':34B,53B,86C,154C,176C 'offscreen-rend':33B 'out-of-bound':75B,117C 'p6fp':137C 'paint':124C 'patch':193C 'path':146C 'pfmc':135C 'pg29':21A 'process':40B,51B,69B,97C,105C,109C,114C,170C 'produc':123C 'question':211C 'read':74B,116C 'receiv':93C 'render':5A,35B,54B,87C,155C,177C 'runtim':36B 'screen':4A 'security@electronjs.org':220C,222C 'separ':163C 'side':186C 'suppli':11A,47B 'trust':8A 'updat':190C 'us':218C 'use':56B,153C,175C 'valid':44B,101C 'version':194C,198C 'webpreferences.offscreen':156C 'workaround':181C,187C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-h3v5-h239-pg29","url":"https://github.com/advisories/GHSA-h3v5-h239-pg29","severity":"low","published_at":"2026-10-22T16:44:33+00:00","modified_at":"2026-10-22T16:44:34+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-114124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114124","severity":null,"published_at":"2026-10-21T18:17:24+00:00","modified_at":"2026-10-23T15:17:25+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}