Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109422NetEase Cloud Music RCE via os.navigateExternal IPC

High 8.1

In plain English

A high-severity security flaw in NetEase Cloud Music for Windows from NetEase. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 55.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.

Affected products (as reported)

Vendor	Product	Versions
NetEase	NetEase Cloud Music for Windows	3.1.383.1.39.205426

Weakness: CWE-749 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description
Product Page product
VulnCheck Advisory: NetEase Cloud Music RCE via os.navigateExternal IPC third-party-advisory