NetEase Cloud Music CVE-2026-109422

Exploitation requires an active adversary-in-the-middle position so the attacker can intercept and forge the client's /pc/upgrade/get upgrade-check API response; the client does not validate the TLS connection and the response is protected only by a publicly known hardcoded AES key, enabling response forgery. The injected content must reach the renderer and call the os.navigateExternal IPC bridge with a file:// scheme URL, which is passed to ShellExecuteW without scheme validation (CWE-749). This affects NetEase Cloud Music for Windows versions 3.1.38 and 3.1.39.205426. Limiting factors: the attacker must first control the network path (hostile Wi-Fi, compromised router/DNS, or upstream interception) - this network-position prerequisite is the AC:H driver - while no victim interaction beyond running the app's normal upgrade check and no authentication are needed.

The vendor-supplied CVSS 4.0 base score is 9.2 (Critical), driven by full high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) via arbitrary local code execution, with no privileges (PR:N) and no user interaction (UI:N) required. The critical counterweight is AC:H: exploitation is NOT a trivial single-packet remote attack - it requires the attacker to first establish an adversary-in-the-middle position on the network and then abuse a publicly known hardcoded AES key to forge the /pc/upgrade/get response over a TLS channel the client fails to validate. No EPSS probability was provided in the input, and the CVE is NOT listed in CISA KEV, so there is no evidence of active, widespread exploitation; a public gist and a VulnCheck advisory are referenced, indicating research-grade exploit/writeup material exists rather than mass in-the-wild weaponization. Net assessment: genuine high-impact RCE but gated behind a network-position prerequisite, so real-world risk is best characterized as targeted (hostile Wi-Fi, compromised router, ISP/DNS-level adversary) rather than opportunistic internet-wide. Note the attack vector is AV:N yet effectively depends on local-network interception - defenders should treat it as a network-adjacent MITM issue despite the network rating.

An attacker on the same untrusted network as the victim (public Wi-Fi, a compromised router, or an upstream/DNS position) intercepts the NetEase Cloud Music client's automatic upgrade check and, using the publicly known AES key, forges a /pc/upgrade/get response over the unvalidated TLS connection. The malicious payload injects an img onerror handler that calls the os.navigateExternal IPC bridge with a file:// URL, which is passed unvalidated to ShellExecuteW and launches an arbitrary local binary as the logged-in user. A public gist referenced in the advisory appears to document the technique, so exploit material is available to adversaries.