CVE-2026-109424: Use of Hard-coded Cryptographic Key in NetEase NetEase Cloud Music for Windows

CVE-2026-109424 identifies a cryptographic weakness in NetEase Cloud Music for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426. The client decrypts /eapi/ and /xeapi/ API response bodies using a fixed, publicly known AES-128-ECB key without any integrity checks. Attackers capable of intercepting or originating server responses can craft valid ciphertexts with PKCS#7 padding under this known key, causing the client to accept forged API responses. This vulnerability serves as a prerequisite for further exploitation, such as reaching the os.navigateExternal bridge, potentially enabling unauthorized actions.

The vulnerability allows attackers who can intercept or originate server responses to forge API responses accepted by the client, potentially leading to further exploitation. This compromises the integrity of API communications and may enable unauthorized interactions with the client, including access to sensitive functionality like the os.navigateExternal bridge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a fix is available, users should exercise caution when using affected versions and avoid untrusted networks where interception is possible.