CVE-2026-109424

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept ...

CVE-2026-109422

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

CVE-2026-109423

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

EUVD-2026-97819

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept ...

CVE-2026-109424 NetEase Cloud Music Weak Encryption via eapi/xeapi

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept ...

CVE-2026-109424

The NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 is vulnerable to a weak encryption flaw. The application decrypts /eapi/ and /xeapi/ API response bodies using a fixed, publicly documented AES-128-ECB key without integrity credentials. This allows atta...

CVE-2026-109423 NetEase Cloud Music TLS Certificate Validation Bypass

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

EUVD-2026-97818

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

CVE-2026-109423

The NetEase Cloud Music client for Windows (cloudmusic.exe ) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability . The software fails to validate the server certificate chain, verify the hostname, or consult the Windows certificate trust store. A network-adjacent...

CVE-2026-109422

The NetEase Cloud Music client for Windows (cloudmusic.exe ) versions 3.1.38 and 3.1.39.205426 is vulnerable to Remote Code Execution (RCE) . The flaw exists in the renderer-process IPC bridge os.navigateExternal, which fails to validate the URL scheme before passing caller-supplied URLs to Shell...

EUVD-2026-97817

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

CVE-2026-109423: Improper Certificate Validation

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

PT-2026-110902

Name of the Vulnerable Software and Affected Versions NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 through 3.1.39.205426 Description The application uses a fixed, publicly documented AES-128-ECB key to decrypt response bodies from the '/eapi/' and '/xeapi/' API endpoints...

CVE-2026-109422: Exposed Dangerous Method or Function

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

PT-2026-110901

Name of the Vulnerable Software and Affected Versions NetEase Cloud Music client for Windows cloudmusic.exe version 3.1.38 NetEase Cloud Music client for Windows cloudmusic.exe version 3.1.39.205426 Description The application fails to validate the server certificate chain, verify the hostname, o...

CVE-2026-109424: Use of Hard-coded Cryptographic Key

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept ...

CVE-2026-90818

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in...

CVE-2026-18995 netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out...

PT-2026-68378

Name of the Vulnerable Software and Affected Versions netease-youdao LobsterAI version 2026.6.10 Description A flaw in the MEDIA Path Handler component allows for remote information disclosure. The issue resides within the parseMediaTokensFromText function located in the...

ncmdump security vulnerability

ncmdump is a software developed by TaurusXin, a personal developer in China. It allows converting downloaded NetEase Cloud Music cache files ncm into MP3 or FLAC formats. Versions of ncmdump prior to 1.4.0 contained security vulnerabilities; these vulnerabilities were caused by null pointer...