CVE-2026-109422 NetEase CVE debrief

Who should care

Defenders responsible for NetEase Cloud Music for Windows deployments should assess exposure and prioritize remediation. This includes IT administrators, security teams, and vulnerability management teams who need to verify affected versions, implement compensating controls, and monitor for suspicious activity related to the vulnerability. Additionally, operators and platform administrators should review the vulnerability and its potential impact on their

Why it matters

CVE-2026-109422 is a critical remote code execution vulnerability in NetEase Cloud Music client for Windows. Defenders should assess exposure, prioritize remediation, and implement compensating controls to restrict access to the renderer process.

• Potential remote code execution under the logged-in user's account
• Possible lateral movement within the network
• Required verification of affected versions and exposure
• Need for compensating controls until remediation is applied

Technical summary

The vulnerability exists in the renderer-process IPC bridge os.navigateExternal in NetEase Cloud Music client for Windows versions 3.1.38 and 3.1.39.205426. An attacker can inject content into the renderer and invoke os.navigateExternal with a file:// URL to execute arbitrary local binaries under the logged-in user's account. The vulnerability is caused by the lack of validation of the URL scheme in the os.navigateExternal function, which passes caller-supplied URLs to ShellExecuteW. This allows an attacker to execute arbitrary local binaries under the logged-in user's account.

Defensive priority

High

Recommended defensive actions

• Assess exposure of NetEase Cloud Music for Windows versions 3.1.38 and 3.1.39.205426
• Verify if the publicly known AES key is being used for /pc/upgrade/get API responses
• Implement compensating controls to restrict access to the renderer process
• Monitor for suspicious activity related to the vulnerability
• Review vendor guidance for patching or mitigating the vulnerability
• Conduct an inventory of affected systems and prioritize remediation
• Track remediation progress and verify the effectiveness of compensating controls

Evidence notes

The CVE record and source item provide details on the vulnerability in NetEase Cloud Music client for Windows. The vulnerability exists in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.