CVE-2026-109422 Details
Description
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.
A remote code execution vulnerability has been identified in the NetEase Cloud Music client for Windows, specifically in versions 3.1.38 and 3.1.39.205426. The issue arises in the renderer-process IPC bridge 'os.navigateExternal', which improperly passes user-supplied URLs to 'ShellExecuteW' without validating the URL scheme. This vulnerability allows an attacker to execute arbitrary local binaries under the logged-in user's account. Exploitation involves injecting content into the renderer, such as by manipulating the '/pc/upgrade/get' API response using a publicly known AES key over an unvalidated TLS connection. The injected content can include a 'file://' URL, which is executed via an 'img' element's 'onerror' event.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/LeoWSY-hashblue/10e5383fc2d4d75faf74a9507c6bba9f | [email protected] | BundleExploitTechnical Analysis |
| https://hr.163.com/product.html/music | [email protected] | Broken LinkVendor |
| https://www.vulncheck.com/advisories/netease-cloud-music-rce-via-os-navigateexternal-ipc | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-749 | Exposed Dangerous Method or Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NetEase Cloud Music | <= 3.1.38 (semver) <= 3.1.39.205426 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |