CVE-2026-109423
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.
Risk Assessment
An attacker can intercept sensitive data, including session credentials, potentially leading to account takeover and privacy breach.
Recommendation
Update NetEase Cloud Music client to a version that fixes TLS certificate validation, or avoid using the client on untrusted networks.
Other vulnerabilities in NetEase Cloud Music client
Original NVD description (English source)
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS