# CVE-2026-109424: NetEase Cloud Music Windows client weak encryption and certificate validation

Source: https://junglewise.ai/threats/cve-2026-109424-netease-cloud-music-client-for-windows-cloudmusic-exe-versions-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109424 · Severity: medium · CVSS 5.9 · Published 2026-10-12

NetEase Cloud Music is a desktop media player for Windows that streams music and manages playlists. The application fails to validate TLS certificates and uses a publicly documented static encryption key for API responses, allowing a network attacker to intercept user sessions, forge API responses, and execute arbitrary commands through a chain of vulnerabilities including an unsanitized update modal.

Technologies: [Netease Cloud Music](https://junglewise.ai/threats/technologies/cloud-music). Vendors: [Netease](https://junglewise.ai/threats/vendors/netease).

## Quick answers

**Is CVE-2026-109424 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109424 being exploited in the wild.

**How severe is CVE-2026-109424?** Medium severity, with a CVSS score of 5.9, published 12 October 2026.

**Which products and versions are affected?** Netease Cloud Music 3.1.38, 3.1.39.205426.

**Is there a fix for CVE-2026-109424?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109424 attacked?** It is attacked over the network or from the adjacent network, in a web application.

**Am I affected by CVE-2026-109424?** Check whether you run Netease Cloud Music at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability chain consists of four independently fixable flaws: (1) disabled TLS certificate validation in the native networking stack (CWE-295), (2) API response encryption using a publicly documented fixed AES-128-ECB key (CWE-321), (3) file:// URI scheme handling in the os.navigateExternal bridge without scheme validation (CWE-939), and (4) unsanitized HTML rendering of server-provided upgradeContent in the update modal (CWE-79). A network-positioned attacker can intercept HTTPS traffic, forge responses with the known encryption key, inject malicious HTML into the update modal, and execute arbitrary commands via ShellExecuteW with user privileges; the update check runs automatically at startup requiring no user interaction.

## Affected products

- NetEase Cloud Music 3.1.38, 3.1.39.205426

## Timeline

- 2026-09-08: disclosed: reported to NetEase Security Response Center
- 2026-10-12: advisory

## References

- [https://gist.github.com/LeoWSY-hashblue/10e5383fc2d4d75faf74a9507c6bba9f](https://gist.github.com/LeoWSY-hashblue/10e5383fc2d4d75faf74a9507c6bba9f)
- [https://hr.163.com/product.html/music](https://hr.163.com/product.html/music)

## Related threats

- [NetEase Cloud Music Windows client TLS certificate validation bypass](https://junglewise.ai/threats/cve-2026-109423-netease-cloud-music-client-for-windows-cloudmusic-exe-versions-3)
- [NetEase Cloud Music Windows remote code execution in IPC bridge](https://junglewise.ai/threats/cve-2026-109422-netease-cloud-music-client-for-windows-cloudmusic-exe-versions-3)