The NetEase Cloud Music client for Windows contains a remote code execution vulnerability in its renderer‑process IPC bridge os.navigateExternal. The bridge accepts caller‑supplied URLs and passes them directly to ShellExecuteW without validating the URL scheme. An attacker who can inject content into the renderer, such as by forging a response from the /pc/upgrade/get API using a publicly known AES key over an unvalidated TLS connection, can trigger os.navigateExternal with a file:// URL via an img onerror payload. This allows the attacker to execute arbitrary local binaries under the logged‑in user’s account, potentially compromising user data and enabling further malicious activity. The primary impact is the ability for an attacker to run arbitrary code as the current Windows user, which can lead to information disclosure, data corruption, or additional privilege escalation if the user is a privileged account. The vulnerability stems from CWE‑749: Improper Validation of Method or Function Parameters, where unsanitized parameters are passed to a sensitive API.

NetEase Cloud Music for Windows client versions 3.1.38 and 3.1.39.205426 are affected. These versions expose the vulnerable os.navigateExternal IPC bridge that passes unsanitized URLs to ShellExecuteW.

The CVSS score of 9.2 indicates a high severity and the lack of an available EPSS score signifies that the probability of exploitation has not been quantified yet. The vulnerability is not currently listed in CISA KEV. Exploitation requires the attacker to compromise the client’s network traffic to inject malicious content, either by forging API responses or by otherwise influencing the data delivered to the renderer. Once the payload is delivered, the attacker can trigger onerror events that cause the renderer to invoke file:// URLs, leading to arbitrary code execution as the logged‑in user.