CVE-2026-109424

Name of the Vulnerable Software and Affected Versions NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 through 3.1.39.205426

Description The application uses a fixed, publicly documented AES-128-ECB key to decrypt response bodies from the '/eapi/' and '/xeapi/' API endpoints. Because there is no integrity credential, an attacker capable of intercepting or originating server responses can create valid ciphertext using PKCS#7 padding. This allows the client to accept forged API responses, which can be used as a step toward further exploitation, such as accessing the os.navigateExternal bridge.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.