CVE-2026-109422: Exposed Dangerous Method or Function in NetEase NetEase Cloud Music for Windows

CVE-2026-109422 is a remote code execution vulnerability in NetEase Cloud Music for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426. The vulnerability arises from the os.navigateExternal IPC bridge in the renderer process, which passes caller-supplied URLs directly to ShellExecuteW without validating the URL scheme. This allows an attacker capable of injecting content into the renderer—such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection—to invoke os.navigateExternal with a file:// URL via an img onerror payload. This leads to arbitrary execution of local binaries with the privileges of the logged-in user.

Successful exploitation allows remote code execution on the affected system with the privileges of the logged-in user. This can lead to full compromise of the user's environment. The vulnerability requires the attacker to inject content into the renderer process, which is feasible by forging API responses due to the use of a publicly known AES key and unvalidated TLS connections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using affected versions 3.1.38 and 3.1.39.205426 of NetEase Cloud Music for Windows, and be cautious of network environments where API responses could be intercepted or forged. Monitor vendor communications for official patches or updates.