CVE-2026-109422: NetEase Cloud Music RCE via os.navigateExternal IPC
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
The affected Windows client versions are 3.1.38 and 3.1.39.205426. The vulnerable component is cloudmusic.exe.
What must an attacker be able to do to exploit this issue?
The attacker must be able to inject content into the application's renderer process. The described path is forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection.
What level of access can successful exploitation provide?
Successful exploitation can execute arbitrary local binaries under the currently logged-in user's account. No prior privileges or user interaction are required according to the supplied vector.
How does the malicious content trigger code execution?
Injected renderer content can invoke the os.navigateExternal IPC bridge with a file:// URL using an img onerror payload. The bridge passes caller-supplied URLs to ShellExecuteW without validating the URL scheme.