NetEase Cloud Music Windows: Critical URL Injection Flaw CVE-2026-109422 Enables Local Binary Execution

A critical remote code execution vulnerability has been identified in the NetEase Cloud Music client for Windows. The flaw allows attackers to run arbitrary local binaries under the context of the logged-in user account.

What happened

The National Vulnerability Database records CVE-2026-109422 as affecting NetEase Cloud Music versions 3.1.38 and 3.1.39.205426 on Windows. The issue resides within the renderer-process inter-process communication bridge, specifically the `os.navigateExternal` function. This component passes caller-supplied URLs directly to the Windows API `ShellExecuteW` without validating the URL scheme.

An attacker can trigger this function using an `img onerror` payload that specifies a `file://` URL. This mechanism allows the execution of arbitrary local binaries on the victim's machine. The attack chain begins with content injection into the renderer process. According to the NVD record, this injection is possible by forging the `/pc/upgrade/get` API response. The forgery exploits a publicly known AES key over a connection that lacks proper TLS validation.

Why it matters

The vulnerability is rated 9.2 on the Common Vulnerability Scoring System, placing it in the critical severity range. It is categorised as CWE-749 in the NVD record. Successful exploitation grants an attacker the same privileges as the current user. The source material states that the flaw allows execution of arbitrary local binaries under the logged-in user's account. The description notes that the API response forgery uses a publicly known AES key over an unvalidated TLS connection.

Next steps

• Identify all endpoints running NetEase Cloud Music versions 3.1.38 or 3.1.39.205426.
• Monitor for unexpected execution of local binaries via `ShellExecuteW`.
• Review network traffic for unvalidated TLS connections to NetEase servers.
• Block access to the `/pc/upgrade/get` API if the client cannot be updated.

What to do and how to stay safe: NetEase Cloud Music

• Audit installed software versions to confirm if affected NetEase clients are present.
• Enforce strict TLS validation policies for all internal application updates.
• Restrict execution of untrusted local binaries through application control tools.
• Monitor for anomalous IPC bridge activity or renderer process crashes.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which NetEase Cloud Music versions are affected by CVE-2026-109422?

Versions 3.1.38 and 3.1.39.205426 of the Windows client are affected.

How do attackers exploit this vulnerability?

They forge API responses using a known AES key to inject content that triggers a file:// URL execution.

What is the CVSS score for this vulnerability?

The National Vulnerability Database assigns it a CVSS score of 9.2.