NetEase Cloud Music CVE-2026-109423

Requires the attacker to hold a man-in-the-middle position on the network path between the victim's Windows client (cloudmusic.exe, versions 3.1.38 or 3.1.39.205426) and NetEase servers - e.g., shared/public WiFi, a rogue access point, ARP spoofing, or a compromised router - and to present a rogue certificate authority certificate. Because the client does not validate the certificate chain, verify the hostname, or consult any Windows certificate trust store, no victim authentication or interaction beyond normal app use is needed. The principal limiting factor is the positional requirement: this cannot be exploited over the open internet without first achieving traffic interception, which constrains it to adjacent/path-controlled scenarios rather than widespread remote exploitation.

This is a genuine high-impact flaw whose real-world risk is tempered by a positional prerequisite. The provided CVSS 4.0 vector (9.1) uses AV:N but pairs it with AC:H, while the description explicitly calls the threat actor 'network-adjacent' - the AC:H and the 'network-adjacent' language both reflect that an attacker cannot reach this over the open internet but must sit in the traffic path (rogue AP, ARP spoofing, malicious/compromised router, hostile WiFi), so this is better understood as an adjacent/path-positioned attack than a broadly remote one. Against a victim who connects over an attacker-controlled network, exploitation is deterministic and needs no victim authentication (PR:N) or interaction (UI:N): the client never validates the certificate chain, hostname, or any Windows trust store, so a rogue CA cert silently succeeds. Impact is high on both confidentiality (decryption plus theft of the MUSIC_U session credential leading to account takeover) and integrity (response forgery). No EPSS score is present in the input, and the product is NOT listed in CISA KEV, so there is no evidence of active exploitation - risk here is driven by impact severity and ease-once-positioned, not by observed in-the-wild use. A public gist reference (LeoWSY-hashblue) is published alongside the VulnCheck advisory and likely contains proof-of-concept or technical detail, but the input does not formally flag POC status, so treat exploit-code availability as probable-but-unconfirmed. Net: prioritize for patching on untrusted/public networks, but it is not an internet-wide mass-exploitation risk.

A user opens NetEase Cloud Music on Windows while on a public or attacker-controlled WiFi network; the attacker, positioned as a man-in-the-middle, presents a rogue CA certificate that the client accepts without validating the chain or hostname. The attacker decrypts the HTTPS session, captures the MUSIC_U authenticated session credential to take over the account, and can rewrite server responses in transit. A gist reference published with the VulnCheck advisory likely provides proof-of-concept detail, though formal POC status is not confirmed in the input.