CVE-2026-109424
5.9MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-321
Impact
Attackers capable of intercepting or originating network traffic can forge API responses to the client, laying groundwork for further exploitation like triggering the os.navigateExternal bridge. Network-level interception (such as a man-in-the-middle position) is required.
Root cause
The Windows client decrypts /eapi/ and /xeapi/ responses using a hardcoded, publicly known AES-128-ECB key without any integrity verification.
Affected systems
NetEase Cloud Music for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Fix & remediation
Specific patched versions are not listed in the advisory; check the vendor release notes and update to a build newer than 3.1.39.205426, or block untrusted network traffic and proxying to the client until patched.
$ powershell -Command "(Get-Item 'C:\Program Files*\Netease\CloudMusic\cloudmusic.exe').VersionInfo.FileVersion"AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.