Remote Code Execution Vulnerability in NetEase Cloud Music Client for Windows
CVE-2026-109422

9.2CRITICAL

Key Information:

Vendor

Netease

Status
Netease Cloud Music For Windows
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109422?

The NetEase Cloud Music client for Windows has a vulnerability in its renderer-process IPC bridge 'os.navigateExternal'. This flaw allows an attacker to exploit unvalidated URLs passed to ShellExecuteW, enabling the execution of arbitrary local binaries. By manipulating content in the renderer via specific API responses and unverified TLS connections, an attacker could trigger os.navigateExternal with malicious file:// URLs. This vulnerability poses a significant risk by allowing unauthorized code execution under the user's account, thereby compromising system integrity.

Affected Version(s)

NetEase Cloud Music for Windows 3.1.38

NetEase Cloud Music for Windows 3.1.39.205426

References

https://gist.github.com/LeoWSY-hashblue/10e5383fc2d4d75fa...
technical-description
https://hr.163.com/product.html/music
product
https://www.vulncheck.com/advisories/netease-cloud-music-...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LeoWSY-hashblue
.