CvFWD contained an out‑of‑bounds write that can compromise service availability. If the vulnerability is triggered, the service may crash or become unresponsive, resulting in a denial‑of‑service condition for users dependent on that component. The likely attack vector is exploitation of the CvFWD subsystem via specially crafted input, but the specific network or local context is not explicitly described in the available data.

The affected vendor is Commvault and the product line is Commvault Cloud. All major components—including CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale—must be patched as they are part of the vulnerable CvFWD code base. Version details are not provided, so all installed instances should be assessed for the presence of the identified out‑of‑bounds write in CvFWD.

The CVSS score of 7.1 classifies this vulnerability as high severity, indicating a significant risk if exploited. EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting it is not yet a widely known, actively exploited problem. An attacker would need to deliver the malicious input to the CvFWD service, which could be an internal or external vector depending on how the service is exposed. If successfully exploited, the attack would have a local or remote impact on the affected system but would not directly provide code execution, only service disruption.