CVE-2026-109424

The NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 is vulnerable to a weak encryption flaw. The application decrypts /eapi/ and /xeapi/ API response bodies using a fixed, publicly documented AES-128-ECB key without integrity credentials. This allows atta...