CVE-2026-109423

Name of the Vulnerable Software and Affected Versions NetEase Cloud Music client for Windows (cloudmusic.exe) version 3.1.38 NetEase Cloud Music client for Windows (cloudmusic.exe) version 3.1.39.205426

Description The application fails to validate the server certificate chain, verify the hostname, or consult the Windows certificate trust store during TLS handshakes. This allows a network-adjacent attacker to perform a man-in-the-middle attack using a rogue certificate authority to intercept and decrypt HTTPS traffic. By doing so, an attacker can capture the MUSIC U session credential used in authenticated API requests and modify server responses in transit, which can lead to account takeover and transport-layer response forgery.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.