Is CVE-2026-109422 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109422 being exploited in the wild.

How severe is CVE-2026-109422?

High severity, with a CVSS score of 8.1, published 12 October 2026.

Which products and versions are affected?

Netease Cloud Music 3.1.38 and 3.1.39.205426.

Is there a fix for CVE-2026-109422?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109422 attacked?

It is attacked over the network or from the adjacent network, in a web application.

Am I affected by CVE-2026-109422?

Check whether you run Netease Cloud Music at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109422: NetEase Cloud Music Windows remote code execution in IPC bridge

CVE-2026-109422 · Severity: high · CVSS 8.1 · Published 2026-10-12

NetEase Cloud Music is a music streaming client for Windows. The application contains critical flaws in network request validation and URL handling that allow an attacker with network access (such as control of a router or Wi-Fi network) to execute arbitrary commands on the victim's computer without any user action beyond launching the app. An attacker can intercept unencrypted communications, forge fake update notifications with malicious code, and trick the application into running arbitrary programs.

Technologies: Netease Cloud Music. Vendors: Netease.

Quick answers

Is CVE-2026-109422 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109422 being exploited in the wild.
How severe is CVE-2026-109422?: High severity, with a CVSS score of 8.1, published 12 October 2026.
Which products and versions are affected?: Netease Cloud Music 3.1.38 and 3.1.39.205426.
Is there a fix for CVE-2026-109422?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109422 attacked?: It is attacked over the network or from the adjacent network, in a web application.
Am I affected by CVE-2026-109422?: Check whether you run Netease Cloud Music at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability chain consists of four independently fixable flaws: (1) missing TLS certificate validation allowing MITM attacks, (2) API responses encrypted with a publicly known static AES key (e82ckenh8dichen8), (3) the os.navigateExternal IPC bridge accepting file:// URLs without scheme validation and passing them to ShellExecuteW, and (4) unsanitized HTML rendering of server-supplied upgradeContent in the update modal. An attacker with network position can forge an update response using the public key, inject script via img onerror handlers, invoke os.navigateExternal with file:// URLs to execute arbitrary binaries under the logged-in user's account. No user interaction beyond normal app startup is required.

Affected products

NetEase Cloud Music 3.1.38 and 3.1.39.205426

Timeline

2026-09-08: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.