Remote Code Execution in NetEase Cloud Music for Windows

The NetEase Cloud Music client for Windows (cloudmusic.exe), specifically versions 3.1.38 and 3.1.39.205426, contains a critical remote code execution vulnerability (CVE-2026-109422). The vulnerability resides in the renderer-process IPC bridge function os.navigateExternal, which incorrectly handles caller-supplied URLs. By failing to validate the URL scheme before passing it to the Windows API function ShellExecuteW, the application allows the execution of arbitrary local files.

The attack vector involves compromising the network traffic between the client and the update server. Because the application utilizes an unvalidated TLS connection and a publicly known AES key for API communications, an attacker can intercept and forge responses for the /pc/upgrade/get endpoint. By injecting an HTML payload containing a malicious img tag with an onerror handler that invokes os.navigateExternal with a file:// URI, the attacker can force the application to execute local binaries under the privileges of the logged-in user.

Impact

Successful exploitation results in full remote code execution in the context of the user running the NetEase Cloud Music client. This could lead to complete system compromise, data theft, or the installation of persistent backdoors on the affected machine. The vulnerability poses a significant risk to the large user base of the NetEase Cloud Music application on Windows platforms.

Recommendation

Prioritize the identification of NetEase Cloud Music installations within the organization. While no patch is referenced in the source, users should restrict application network access and monitor for suspicious child processes spawned by cloudmusic.exe.

• Audit endpoints for the presence of NetEase Cloud Music versions 3.1.38 and 3.1.39.205426.
• Monitor for instances of cloudmusic.exe spawning unexpected child processes, specifically command shells or non-standard binaries, using EDR or Sysmon telemetry.
• Restrict the ability for cloudmusic.exe to initiate network connections to untrusted update servers via endpoint firewall policies.