NetEase Cloud Music for Windows: Remote code execution via os.navigateExternal IPC bridge
Summary
The Windows desktop client of NetEase Cloud Music (cloudmusic.exe), versions 3.1.38 and 3.1.39.205426, allows remote code execution. The renderer IPC function os.navigateExternal passes URLs to ShellExecuteW without checking the URL scheme, so injected content can start local files via a file:// URL. An attacker must first be in a network position between the client and its update server, where a forged update response with an img onerror payload is rendered automatically at startup. Any code then runs with the rights of the logged-in user.
Affected
- NetEase Cloud Music for Windows 3.1.38
- NetEase Cloud Music for Windows 3.1.39.205426
- Other versions: not confirmed as affected or unaffected.
Fixed in
Unknown. No vendor advisory or fixed version was found.
Workaround
- Restrict or block network access of the client until a fixed version is available.
- Uninstall or block cloudmusic.exe on business devices.
- Keep the client off corporate laptops used on public or untrusted networks.
Exploitation
- Public exploit: not found according to VulDB.
- Exploited in the wild: not known.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Attack requires a network position (for example rogue Wi-Fi or MITM).
Our recommendation
- Inventory all Windows endpoints for NetEase Cloud Music 3.1.38 and 3.1.39.205426.
- Uninstall the client on business devices or block it until NetEase publishes a fixed version.
- Do not use the client on public or untrusted networks.
- Check the NVD record and the VulnCheck advisory for updates, as the NVD status is still deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- VulDB entry 417211 vuldb.com
- OpenCVE CVE-2026-109422 app.opencve.io
- Public technical gist gist.github.com
- Vulners Rapid7 record vulners.com
- HOL Guard CVE page hol.org
- CraftedSignal brief feed.craftedsignal.io
- NetEase product page hr.163.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:41.
Original description (NVD)
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.