Remote Code Execution in NetEase Cloud Music Windows Client

Executive Summary

CVE-2026-109422 is a remote code execution vulnerability in NetEase Cloud Music for Windows versions 3.1.38 and 3.1.39.205426. It exists in the renderer-process IPC bridge os.navigateExternal, which passes user-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker can exploit this by injecting malicious content into the renderer, such as via a forged API response, and using an img onerror payload with a file:// URL to execute arbitrary local binaries under the logged-in user's account.

Useful 0 Not Useful 0

Detection Guidance

Check if NetEase Cloud Music for Windows versions 3.1.38 or 3.1.39.205426 are installed. Inspect network traffic for unvalidated TLS connections to the /pc/upgrade/get API endpoint. Monitor for suspicious file:// URI executions via ShellExecuteW in process logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary code on your system without your interaction. If you use the vulnerable NetEase Cloud Music client, an attacker on the same network or with access to your network traffic could exploit this to run malicious programs, steal data, or take control of your computer under your user privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using the vulnerable software may face compliance breaches, legal penalties, and reputational damage due to potential data breaches or unauthorized system access.

Useful 0 Not Useful 0

Mitigation Strategies

Uninstall or update NetEase Cloud Music to a patched version. Block outbound connections to NetEase servers at the firewall level. Disable the os.navigateExternal IPC bridge if possible. Restrict user permissions to limit arbitrary code execution impact.

Useful 0 Not Useful 0