CVE-2026-109422 in Cloud Music
Summary
by MITRE • 10/12/2026
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in NetEase Cloud Music client for Windows versions 3.1.38 and 3.1.39.205426 represents a critical remote code execution flaw rooted in improper input validation within the application’s inter-process communication bridge. Specifically, the defect resides in the os.navigateExternal function, which serves as an interface between the renderer process and the main system processes of the desktop client. This component is designed to handle navigation requests that involve external protocols or file paths. However, it fails to adequately validate the scheme of URLs passed by caller-supplied inputs before forwarding them to ShellExecuteW, a Windows API function used to perform operations on files and folders such as opening documents or executing programs. By allowing unvalidated URL schemes to reach this system-level execution mechanism, the application creates a direct pathway for attackers to trigger arbitrary binary executions with the privileges of the currently logged-in user.
The operational impact of this vulnerability is severe due to its potential for remote exploitation through content injection rather than requiring direct network access to vulnerable endpoints in a traditional sense. An attacker can exploit this flaw by injecting malicious content into the renderer process, effectively tricking the application into processing a crafted request. A primary vector for achieving this injection involves forging responses from the /pc/upgrade/get API endpoint. This exploitation is feasible because the client utilizes a publicly known AES key to encrypt or decrypt communication data over an unvalidated TLS connection. The lack of proper certificate validation allows man-in-the-middle attackers to intercept and modify traffic, injecting malicious payloads that trigger the vulnerable os.navigateExternal function via specific HTML elements such as img tags with onerror event handlers. When triggered, these handlers can pass file:// URLs directly to the navigation bridge, bypassing security checks and resulting in the execution of arbitrary local binaries.
From a technical classification perspective, this vulnerability aligns closely with CWE-94, which describes Improper Control of Generation of Code (Code Injection), specifically involving the injection of commands or scripts through web application interfaces that interact with system-level APIs. The failure to validate URL schemes before passing them to ShellExecuteW is a classic example of insufficient sanitization leading to arbitrary code execution. Furthermore, in terms of offensive security frameworks such as MITRE ATT&CK, this exploit maps directly to T1204, User Execution, where the victim must interact with malicious content, and potentially T1566.001, Phishing: Spearphishing Attachment or Link, if delivered via deceptive means. The use of a known encryption key over an unvalidated TLS connection also highlights significant weaknesses in secure transport layer implementation, contributing to CWE-295, Improper Certificate Validation, which facilitates the initial injection phase of the attack chain.
Mitigation strategies for this vulnerability must address both the immediate code flaw and the underlying architectural security failures. The most critical remediation step is implementing strict allow-listing or validation logic within the os.navigateExternal function to ensure that only expected and safe URL schemes are processed, explicitly blocking file:// protocols unless absolutely necessary and even then with rigorous sanitization. Additionally, developers must eliminate reliance on hardcoded or publicly known encryption keys for sensitive API communications. Implementing proper TLS certificate pinning would prevent man-in-the-middle attacks from modifying the /pc/upgrade/get responses, thereby neutralizing the primary injection vector. Regular security audits focusing on IPC bridges and external command execution functions are essential to identify similar patterns in other components of the application. Users should immediately update to patched versions if available or restrict network permissions for the client executable to limit potential exploitation impact until a permanent fix is deployed by NetEase.