NetEase Cloud Music Windows Client Has Critical Remote Code Execution Flaw
A high-severity vulnerability in the Windows client allows attackers to run local binaries via manipulated IPC bridges and unvalidated connections.
Key points
- CVE-2026-109422 is rated 9.2 Critical by the National Vulnerability Database.
- The flaw exists in NetEase Cloud Music versions 3.1.38 and 3.1.39.205426.
- Attackers can exploit the issue by forging API responses using a known AES key.
The National Vulnerability Database has published CVE-2026-109422, identifying a critical remote code execution vulnerability in the NetEase Cloud Music client for Windows. This flaw affects specific recent versions of the application and allows attackers to execute arbitrary code on affected systems.
At a glance
- CVE
- CVE-2026-109422
- Product
- NetEase Cloud Music for Windows
- CVSS
- 9.2 Critical
- Weakness
- CWE-749
- Exploited
- No known exploitation
The vulnerability stems from insufficient validation in the renderer-process IPC bridge, specifically within the os.navigateExternal function. According to the NVD record, this component passes caller-supplied URLs directly to ShellExecuteW without checking the URL scheme. This lack of validation creates a pathway for executing local binaries.
Technical Context and Attack Vector
The exploit chain requires an attacker to inject content into the application's renderer process. The NVD description notes that this can be achieved by forging the /pc/upgrade/get API response. This API communication relies on an unvalidated TLS connection, which weakens the integrity of the data exchange.
Attackers can leverage a publicly known AES key to decrypt or manipulate this API traffic. Once the content is injected, the attacker can invoke os.navigateExternal with a file:// URL. This is often done through an img onerror payload, which triggers the function automatically when the browser engine processes the malformed image tag.
Affected Versions and Impact
The National Vulnerability Database lists two specific versions of the NetEase Cloud Music Windows client as affected: version 3.1.38 and version 3.1.39.205426. These versions contain the vulnerable cloudmusic.exe executable that hosts the flawed IPC bridge.
The severity rating for CVE-2026-109422 is 9.2, which falls into the Critical category under CVSS scoring. The weakness is classified under CWE-749, indicating a failure to properly handle or validate external inputs that lead to unintended execution. Successful exploitation results in arbitrary code execution under the context of the logged-in user account.
What should you do?
Security professionals should monitor internal endpoints for installations of the affected NetEase Cloud Music versions. Since no patch or fix has been confirmed in the source material, organizations should assess the risk of allowing this application on corporate networks. Users should be aware that the application connects to external APIs using unvalidated TLS connections, which could expose them to man-in-the-middle style attacks if network integrity is compromised.
What to do and how to stay safe: NetEase Cloud Music
- Audit inventory systems to identify any endpoints running NetEase Cloud Music versions 3.1.38 or 3.1.39.205426.
- Restrict network access to the /pc/upgrade/get API endpoint to prevent unauthorized manipulation of API responses.
- Monitor for unusual process creation or execution of local binaries triggered by the cloudmusic.exe renderer process.
- Wait for the vendor to release an official update that addresses the URL validation flaw in the IPC bridge.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109422?
The National Vulnerability Database rates the severity of CVE-2026-109422 as 9.2, which is classified as Critical.
Which versions of NetEase Cloud Music are affected?
The vulnerability affects NetEase Cloud Music for Windows versions 3.1.38 and 3.1.39.205426.
How do attackers exploit this vulnerability?
Attackers can forge API responses using a known AES key over an unvalidated TLS connection to inject content that triggers arbitrary code execution via a file:// URL.
