Weak encryption vulnerability in NetEase Cloud Music for Windows

CVE-2026-109424

What is CVE-2026-109424?

The NetEase Cloud Music client for Windows versions 3.1.38 and 3.1.39.205426 is susceptible to a weak encryption vulnerability. This issue arises from the use of a fixed and publicly documented AES-128-ECB key for decrypting response bodies from the /eapi/ and /xeapi/ APIs. The lack of an integrity credential allows attackers to intercept or modify server responses, enabling them to create valid ciphertexts with PKCS#7 padding, which the client may erroneously validate. This vulnerability poses a significant risk as it can facilitate further exploitation, such as accessing sensitive internal functions.

References