Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

NetEase Cloud Music for Windows can run programs without permission

CVE-2026-109422 · published today
Summary

The Windows version of NetEase Cloud Music (versions 3.1.38 and 3.1.39.205426) may let an attacker cause the program to launch any file on the computer. This happens when malicious content is injected into the app and a specially crafted link is used, allowing the attacker to run code with the rights of the logged‑in user. Update to a patched version or restrict network access to the upgrade service until the fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
netease netease cloud music for windows 3.1.38
Original advisory text
NetEase Cloud Music RCE via os.navigateExternal IPC
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.2 Critical
Type
CWE-749Exposed Dangerous Method or Function
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-109422 · NVD
CVE-2026-109422 · MITRE
Track software like this
Free during beta