NetEase Cloud Music for Windows hit by two high-severity CVEs

NetEase Cloud Music client for Windows versions 3.1.38 and 3.1.39.205426 contain two vulnerabilities tracked as CVE-2026-109422 and CVE-2026-109423.

Remote code execution flaw allows arbitrary binary execution. CVE-2026-109422 is rated 8.1 under CVSS 3.1 and 9.2 under CVSS 4.0 by VulnCheck, which filed the records as the CVE numbering authority. NVD has not published its own scores. The renderer-process IPC bridge os.navigateExternal passes caller-supplied URLs to ShellExecuteW without scheme validation. An attacker who can inject content into the renderer, for example by forging the /pc/upgrade/get API response with a publicly known AES key over an unvalidated TLS connection, can trigger a file:// URL via an img onerror payload to run arbitrary local binaries under the logged-in user account.

TLS certificate validation bypass enables traffic interception. CVE-2026-109423 is rated 7.4 under CVSS 3.1 and 9.1 under CVSS 4.0 by VulnCheck (the CNA). NVD has not published its own scores. The client fails to validate the server certificate chain, verify the hostname, or consult the Windows certificate trust store. A network-adjacent attacker can perform a man-in-the-middle attack with a rogue certificate authority to decrypt HTTPS traffic, capture the MUSIC_U session credential from authenticated API requests, and modify server responses in transit.

Both issues share the same affected versions. The vulnerabilities were published to the NVD on 2026-10-12. Public references include a detailed gist and advisories from VulnCheck that describe the exploitation paths.

Attack chains combine the two flaws. The TLS bypass can be used to forge API responses that feed malicious payloads into the IPC bridge, enabling remote code execution without direct user interaction beyond running the client.