CVE-2026-109422

Name of the Vulnerable Software and Affected Versions NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 through 3.1.39.205426

Description A remote code execution issue exists in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to the ShellExecuteW() function without validating the URL scheme. An attacker can inject content into the renderer by forging the '/pc/upgrade/get' API endpoint response using a known AES key over an unvalidated TLS connection. This allows the attacker to invoke os.navigateExternal with a file:// URL via an img onerror payload to execute arbitrary local binaries under the account of the logged-in user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.