{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/netease/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:netease:cloud_music:3.1.38:*:*:*:*:windows:*:*","cpe:2.3:a:netease:cloud_music:3.1.39.205426:*:*:*:*:windows:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-109422"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cloud Music (3.1.38, 3.1.39.205426)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","cve-2026-109422","windows","ipc"],"_cs_type":"advisory","_cs_vendors":["NetEase"],"content_html":"\u003cp\u003eThe NetEase Cloud Music client for Windows (cloudmusic.exe), specifically versions 3.1.38 and 3.1.39.205426, contains a critical remote code execution vulnerability (CVE-2026-109422). The vulnerability resides in the renderer-process IPC bridge function \u003ccode\u003eos.navigateExternal\u003c/code\u003e, which incorrectly handles caller-supplied URLs. By failing to validate the URL scheme before passing it to the Windows API function \u003ccode\u003eShellExecuteW\u003c/code\u003e, the application allows the execution of arbitrary local files.\u003c/p\u003e\n\u003cp\u003eThe attack vector involves compromising the network traffic between the client and the update server. Because the application utilizes an unvalidated TLS connection and a publicly known AES key for API communications, an attacker can intercept and forge responses for the \u003ccode\u003e/pc/upgrade/get\u003c/code\u003e endpoint. By injecting an HTML payload containing a malicious \u003ccode\u003eimg\u003c/code\u003e tag with an \u003ccode\u003eonerror\u003c/code\u003e handler that invokes \u003ccode\u003eos.navigateExternal\u003c/code\u003e with a \u003ccode\u003efile://\u003c/code\u003e URI, the attacker can force the application to execute local binaries under the privileges of the logged-in user.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote code execution in the context of the user running the NetEase Cloud Music client. This could lead to complete system compromise, data theft, or the installation of persistent backdoors on the affected machine. The vulnerability poses a significant risk to the large user base of the NetEase Cloud Music application on Windows platforms.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the identification of NetEase Cloud Music installations within the organization. While no patch is referenced in the source, users should restrict application network access and monitor for suspicious child processes spawned by \u003ccode\u003ecloudmusic.exe\u003c/code\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAudit endpoints for the presence of NetEase Cloud Music versions 3.1.38 and 3.1.39.205426.\u003c/li\u003e\n\u003cli\u003eMonitor for instances of \u003ccode\u003ecloudmusic.exe\u003c/code\u003e spawning unexpected child processes, specifically command shells or non-standard binaries, using EDR or Sysmon telemetry.\u003c/li\u003e\n\u003cli\u003eRestrict the ability for \u003ccode\u003ecloudmusic.exe\u003c/code\u003e to initiate network connections to untrusted update servers via endpoint firewall policies.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T20:32:23Z","date_published":"2026-10-12T20:32:23Z","id":"https://feed.craftedsignal.io/briefs/2026-10-netease-rce/","summary":"NetEase Cloud Music versions 3.1.38 and 3.1.39.205426 are vulnerable to remote code execution due to improper validation of URL schemes in the IPC bridge, allowing arbitrary local binary execution via API response forgery.","title":"Remote Code Execution in NetEase Cloud Music for Windows","url":"https://feed.craftedsignal.io/briefs/2026-10-netease-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - NetEase","version":"https://jsonfeed.org/version/1.1"}