Is CVE-2026-109424 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109424 being exploited in the wild.

How severe is CVE-2026-109424?

Medium severity, with a CVSS score of 5.9, published 12 October 2026.

Which products and versions are affected?

Netease Cloud Music 3.1.38, 3.1.39.205426.

Is there a fix for CVE-2026-109424?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109424 attacked?

It is attacked over the network or from the adjacent network, in a web application.

Am I affected by CVE-2026-109424?

Check whether you run Netease Cloud Music at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109424: NetEase Cloud Music Windows client weak encryption and certificate validation

CVE-2026-109424 · Severity: medium · CVSS 5.9 · Published 2026-10-12

NetEase Cloud Music is a desktop media player for Windows that streams music and manages playlists. The application fails to validate TLS certificates and uses a publicly documented static encryption key for API responses, allowing a network attacker to intercept user sessions, forge API responses, and execute arbitrary commands through a chain of vulnerabilities including an unsanitized update modal.

Technologies: Netease Cloud Music. Vendors: Netease.

Quick answers

Is CVE-2026-109424 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109424 being exploited in the wild.
How severe is CVE-2026-109424?: Medium severity, with a CVSS score of 5.9, published 12 October 2026.
Which products and versions are affected?: Netease Cloud Music 3.1.38, 3.1.39.205426.
Is there a fix for CVE-2026-109424?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109424 attacked?: It is attacked over the network or from the adjacent network, in a web application.
Am I affected by CVE-2026-109424?: Check whether you run Netease Cloud Music at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability chain consists of four independently fixable flaws: (1) disabled TLS certificate validation in the native networking stack (CWE-295), (2) API response encryption using a publicly documented fixed AES-128-ECB key (CWE-321), (3) file:// URI scheme handling in the os.navigateExternal bridge without scheme validation (CWE-939), and (4) unsanitized HTML rendering of server-provided upgradeContent in the update modal (CWE-79). A network-positioned attacker can intercept HTTPS traffic, forge responses with the known encryption key, inject malicious HTML into the update modal, and execute arbitrary commands via ShellExecuteW with user privileges; the update check runs automatically at startup requiring no user interaction.

Affected products

NetEase Cloud Music 3.1.38, 3.1.39.205426

Timeline

2026-09-08: disclosed: reported to NetEase Security Response Center
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.