NetEase Cloud Music Windows RCE: AES Key Forgery Enables Arbitrary Code Execution via IPC Bridge

A critical remote code execution vulnerability exists in the NetEase Cloud Music client for Windows. The flaw, tracked as CVE-2026-109422, carries a CVSS score of 9.2. It affects specific versions of the cloudmusic.exe application. Security researchers identified the issue in the renderer-process IPC bridge component. The vulnerability allows an attacker to execute arbitrary code on the victim's machine. This occurs when the application processes malicious URLs without proper validation. The flaw is rated as critical severity by the National Vulnerability Database.

Root cause

The core issue lies in the os.navigateExternal function within the renderer-process IPC bridge. This function passes caller-supplied URLs directly to the ShellExecuteW system call. It fails to validate the URL scheme before execution. This lack of validation allows dangerous protocols to be processed. Specifically, file:// URLs can be passed through without restriction. This design error enables the execution of local binaries. The application runs these binaries under the logged-in user's account privileges.

Attack path

An attacker must first inject malicious content into the renderer process. This can be achieved by forging the /pc/upgrade/get API response. The connection uses an unvalidated TLS link with a publicly known AES key. This allows the attacker to manipulate the data stream. Once injected, an img onerror payload can invoke os.navigateExternal. The payload specifies a file:// URL pointing to a local binary. This triggers the execution of the arbitrary code on the system.

Affected versions

• NetEase Cloud Music for Windows version 3.1.38
• NetEase Cloud Music for Windows version 3.1.39.205426

Mitigation

No official patch or fix has been confirmed by NetEase for these vulnerabilities. Users should monitor vendor announcements for updates. Avoid using the affected versions until a secure update is available. Review system logs for unusual executable launches. Ensure TLS connections are properly validated where possible.

What to do and how to stay safe: NetEase

• Check your installed version of NetEase Cloud Music against the affected list.
• Monitor network traffic for unexpected connections to upgrade endpoints.
• Once the vendor provides an update, apply it immediately to your systems.
• Review local executable permissions to limit potential damage from such flaws.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-109422?

It is a critical remote code execution vulnerability in NetEase Cloud Music for Windows.

Which versions are affected?

Versions 3.1.38 and 3.1.39.205426 of the Windows client are affected.

Is there a fix available?

No fix has been confirmed yet by the vendor.