A heap‑based buffer overflow was discovered in the MediaAgent component of Commvault Cloud. When the overflow is triggered, the MediaAgent process crashes, causing the service to become unavailable and leading to potential full application downtime. The flaw does not allow attackers to gain code execution or elevate privileges, but it does compromise the reliability of the data protection service.

All installations of Commvault Cloud that run the MediaAgent and HyperScale services are affected. The CVE does not specify exact product versions; therefore any deployment of these services should be considered at risk until the maintenance release containing the fix is applied.

The CVSS score of 8.7 signals a high‑severity vulnerability. No EPSS score is provided, and the issue is not listed in CISA’s KEV catalog, indicating no known public exploits yet. The vulnerability is a heap corruption that can be triggered through the MediaAgent service interface, which may be accessible over the network; this suggests the attack vector is likely remote (though local exploitation is also plausible if an attacker can interact with the service). Because the flaw results only in denial of service, an attacker needs only to send crafted requests to the vulnerable service to impact availability.