AES Key Flaw in NetEase Cloud Music Windows Lets Attackers Execute Arbitrary Local Binaries

NetEase Cloud Music for Windows contains a critical remote code execution flaw that allows attackers to run arbitrary local binaries on affected systems. The National Vulnerability Database assigned CVE-2026-109422 to this issue, giving it a CVSS score of 9.2. The vulnerability impacts versions 3.1.38 and 3.1.39.205426 of the client application.

In plain English

The flaw exists in how the application handles links within its internal communication bridge. Specifically, the renderer-process IPC bridge function os.navigateExternal passes URLs to the system shell without checking if the URL scheme is safe. This lack of validation allows an attacker to trick the system into executing local files instead of opening web pages.

An attacker can exploit this by injecting malicious content into the application's renderer process. According to the NVD record, this injection can occur by forging the /pc/upgrade/get API response. The attack relies on using a publicly known AES key over a connection that does not validate TLS certificates.

Once the content is injected, the attacker can use an img onerror payload to trigger the os.navigateExternal function. By passing a file:// URL to this function, the application calls ShellExecuteW. This results in the execution of arbitrary local binaries under the account of the logged-in user.

The background

The National Vulnerability Database classifies the underlying weakness as CWE-749, which relates to improper handling of special elements in a data stream. The issue stems from the application trusting user-supplied or injected data without sufficient sanitization before passing it to system-level execution commands.

This specific chain of events highlights the risks of using known cryptographic keys in client-side applications. The ability to forge API responses due to the lack of TLS validation creates an entry point for the initial content injection. That suggests the security model relies heavily on transport layer assumptions that are not enforced.

What changes now

No patch or fix has been confirmed for these versions of the NetEase Cloud Music client. Users running versions 3.1.38 and 3.1.39.205426 remain exposed to this critical risk. Security teams should monitor for vendor updates while assessing their exposure to this specific attack vector.

The severity rating of 9.2 indicates a high potential for impact. Because the execution occurs under the logged-in user's account, the attacker gains the same privileges as the user. This could lead to further compromise of the system if the user has administrative rights.

What to do and how to stay safe: NetEase Cloud Music

• Audit your environment to identify any Windows systems running NetEase Cloud Music versions 3.1.38 or 3.1.39.205426.
• Monitor network traffic for unusual API calls to the /pc/upgrade/get endpoint that may indicate exploitation attempts.
• Enforce strict TLS certificate validation policies for all internal and external API communications to prevent response forgery.
• Wait for the vendor to release an official update before considering the vulnerability remediated.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of NetEase Cloud Music are affected by CVE-2026-109422?

The vulnerability affects NetEase Cloud Music for Windows versions 3.1.38 and 3.1.39.205426.

How does an attacker exploit this vulnerability?

An attacker injects content by forging an API response using a known AES key, then triggers a file:// URL via the IPC bridge to execute local binaries.

Is there a fix available for this critical flaw?

No fix has been confirmed yet for the affected versions of the NetEase Cloud Music Windows client.