The vulnerability is an integer overflow in the CvFWD component that can cause the service to crash and become unavailable. The flaw arises from improper bounds checking of numeric values and is classified as CWE‑190. An attacker can trigger the overflow by providing a numeric input that exceeds the expected range, leading to a loss of availability for the affected service.

Affected installations include all hosted and on‑premises CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale components of Commvault Cloud. The advisory does not list specific product versions, so any deployment of the component that contains CvFWD is potentially vulnerable until the maintenance release is applied.

The CVSS score of 7.1 signifies moderate to high impact on service availability. The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. No details about the attack vector or required conditions are provided; consequently, it remains uncertain whether remote or local exploitation is necessary or if typical user activity could trigger the overflow.