CVE-2026-109422 NetEase Cloud Music RCE via os.navigateExternal IPC
Attackers can execute arbitrary code by injecting content into the renderer process to trigger unsafe IPC calls that launch local binaries via ShellExecuteW.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109422?
CVE-2026-109422 is a critical code injection vulnerability in NetEase Cloud Music for Windows, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.
Weakness: CWE-749
Which versions are affected by CVE-2026-109422?
How do I fix CVE-2026-109422?
No fix has been published for CVE-2026-109422 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-109422 being exploited?
There is no known exploitation of CVE-2026-109422 in the wild and no public exploit code.
Sources
Also known as GHSA-8rjw-mvfx-hpfv.