CVE-2026-109422 is a high severity remote code execution flaw (CVSS 8.1) in the NetEase Cloud Music client for Windows, versions 3.1.38 and 3.1.39.205426. An internal bridge passes URLs to the system shell without checking the scheme. The record names no fixed version, so update the client when the vendor offers one.
What's affected
The record says cloudmusic.exe versions 3.1.38 and 3.1.39.205426 are affected. VulnCheck's advisory, which we fetched, lists NetEase Cloud Music for Windows up to 3.1.38 and 3.1.39.205426. Neither names a fixed version, so check with the vendor.
Severity conflict. The record scores the flaw 8.1 under CVSS 3.1, which is High. VulnCheck labels its severity critical, with a CVSS 4.0 score of 9.2. Both are on the page, so plan for the higher reading if the client is installed on machines that matter.
The weakness is CWE-749, exposed dangerous method or function. The record's vector is network reachable, with high attack complexity and no privileges. The high complexity reflects the conditions the record lists.
The record describes the component as the renderer process bridge os.navigateExternal, which hands caller supplied URLs to the Windows ShellExecuteW function without validating the scheme. It says an attacker who can inject content into the renderer, for example by forging a response from the client's upgrade check that travels over an unvalidated TLS connection, can make the client run local programs with the logged in user's rights.
How to check if you're exposed
Find the installed client version. On a Windows machine, right click the executable, open Properties and read the product version, or check the About page in the app. Compare it with 3.1.38 and 3.1.39.205426.
For a managed fleet, use your endpoint inventory to find the application by name and version. Consumer media players are a common blind spot, since they are installed by users and not by IT.
The record also points to a network condition: a connection whose certificate is not validated. If staff use the client on networks you do not control, such as public Wi-Fi, an interception position is easier to obtain. Review whether such software should run on corporate laptops at all.
Look at the VulnCheck advisory and the vendor product page for notes on a newer build.
What to do now
- Check the vendor site and the in-app updater for a version newer than 3.1.39.205426 and install it when it is available.
- If no fixed version exists, consider uninstalling the client from corporate devices, or blocking it with application control.
- Keep staff off untrusted networks for personal apps on work devices, or use a VPN.
- Run endpoint protection that watches for programs started from unexpected parents.
- Add consumer applications to your software inventory so the next advisory finds them.
Why it matters
Desktop apps built on web technology run a web page inside the application, and often give that page a bridge to the operating system. The bridge is a powerful door. If it accepts any URL and hands it to the shell, a file location or program path starts a program just as a web address opens a browser.
The record explains the failure: the bridge did not check the URL scheme. The page that calls the bridge is supposed to be the vendor's own content, so the design trusts it. That trust breaks when content can be injected, and the record says a forged update response over an unvalidated connection can do it.
Two defences would each have stopped the chain: validating the scheme and allowing only web addresses, and validating the certificate on the update check. The weakness is the combination, and the fix needs both. The record does not mark this CVE as known exploited, though it does mention a publicly known key used in the described path.
Quick check
Is this High or Critical?
The record scores 8.1, which is High under CVSS 3.1. VulnCheck labels it critical with a CVSS 4.0 score of 9.2.
Is there a patched version?
The record and the advisory name none. Check with the vendor.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
