QAPI contains a stack‑based buffer overflow that can be triggered by malformed API requests. The overflow corrupts stack memory within the service process, leading to an abrupt crash and a loss of service availability. The primary consequence is denial of service; no evidence suggests that an attacker can achieve code execution or escalation, but the crash can impact customers’ data access and system reliability.

Vulnerable components are found in the Commvault Cloud platform, specifically the CommServe, Web Server, Command Center and Index Server services. No version numbers are provided, but the advisory states that all these services must be updated to the resolved maintenance release.

The CVSS score of 7.1 indicates moderate severity, and the exploit probability is currently unavailable. The vulnerability is not listed in the CISA KEV catalog, but because it can cause a denial of service, systems that rely on uninterrupted operation are at risk. An attacker would need to send crafted QAPI requests, likely over a network channel; no additional authentication or privilege constraints are described in the advisory, so remote exploitation is plausible if the QAPI endpoint is exposed.