CVE-2026-109424: Netease Cloud Music For Windows

Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days.

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.

Affected products

• Netease Netease Cloud Music For Windows: version 3.1.38 only; version 3.1.39.205426 only

Published 2026-10-12. Last modified 2026-10-16.