{"metadata": {"vulnerability": "CVE-2026-109422", "count": 13, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-09-29T00:00:00Z", "date_only": false, "value": "2026-09-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109422", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T15:52:36.681Z", "date_only": false, "value": "2026-10-12T15:52:36.681Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109422", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T19:33:32.062Z", "date_only": false, "value": "2026-10-12T19:33:32.062Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109422", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T19:33:32.062Z", "date_only": false, "value": "2026-10-12T19:33:32.062Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109422", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-12T19:33:32.062Z", "date_only": false, "value": "2026-10-12T19:33:32.062Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-109422", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T19:45:16.866Z", "date_only": false, "value": "2026-10-12T19:45:16.866468Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117429653753234425", "record": "CVE-2026-109422", "field": "creation_timestamp", "uuid": "e53719ae-10ed-4281-b942-e77e848cf33d", "content": "CVE-2026-109422 NetEase Cloud Music RCE via os.navigateExternal IPC NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109422https://gist.github.com/LeoWSY-hashblue/10e5383fc2d4d75faf74a9507c6bba9fhttps://hr.163.com/product.html/musichttps://www.vulncheck.com/advisories/netease-cloud-music-rce-via-os-navigateexternal-ipc#NetEase #NetEaseCloudMusicforWindows#CVE_2026_109422#bot", "url": "https://infosec.exchange/users/cve/statuses/117429653753234425"}, {"timestamp": "2026-10-12T20:17:08Z", "date_only": false, "value": "2026-10-12T20:17:08Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8RJW-MVFX-HPFV", "record": "GHSA-8RJW-MVFX-HPFV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T20:17:08.840Z", "date_only": false, "value": "2026-10-12T20:17:08.840", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109422", "record": "FKIE_CVE-2026-109422", "field": "published"}, {"timestamp": "2026-10-12T20:17:08.840Z", "date_only": false, "value": "2026-10-12T20:17:08.840", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109422", "record": "FKIE_CVE-2026-109422", "field": "lastModified"}, {"timestamp": "2026-10-12T20:40:05.763Z", "date_only": false, "value": "2026-10-12T20:40:05.763765Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpetz5m232q", "record": "CVE-2026-109422", "field": "creation_timestamp", "uuid": "c83e57cf-8b88-40a4-8f12-186aeeb8a296", "content": "CVE-2026-109422 - netease cloud music for windows\nThe Windows version of NetEase Cloud Music (versions 3.1.38 and 3.1.39.205426) may let an attacker cause the program to launch any file on the computer. This happens\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#netease #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxpetz5m232q"}, {"timestamp": "2026-10-12T21:31:56Z", "date_only": false, "value": "2026-10-12T21:31:56Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8RJW-MVFX-HPFV", "record": "GHSA-8RJW-MVFX-HPFV", "field": "published"}, {"timestamp": "2026-10-12T21:31:56Z", "date_only": false, "value": "2026-10-12T21:31:56Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8RJW-MVFX-HPFV", "record": "GHSA-8RJW-MVFX-HPFV", "field": "modified"}, {"timestamp": "2026-10-12T22:08:32.103Z", "date_only": false, "value": "2026-10-12T22:08:32.103208Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxpjs5stuk24", "record": "CVE-2026-109422", "field": "creation_timestamp", "uuid": "03823e5e-6243-4c3c-8114-1634a76d9d8c", "content": "\ud83d\udea8 CVE-2026-109422 \u2014 CVSS 9.2 CRITICAL\n\nNetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-109422\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxpjs5stuk24"}]}