Home

Description

A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execute arbitrary code with elevated privileges. The vulnerability has been resolved in versions 11.20.202, 11.28.124, 11.32.65, 11.34.37, and 11.36.15.

PUBLISHED Reserved 2025-07-23 | Published 2025-07-25 | Updated 2025-11-22 | Assigner VulnCheck




HIGH: 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-427 Uncontrolled Search Path Element

Product status

Default status
unaffected

11.20.0 (semver) before 11.20.202
affected

11.28.0 (semver) before 11.28.124
affected

11.32.0 (semver) before 11.32.65
affected

11.34.0 (semver) before 11.34.37
affected

11.36.0 (semver) before 11.36.15
affected

Credits

Commvault finder

References

documentation.commvault.com/...yadvisories/CV_2024_09_2.html vendor-advisory patch

www.vulncheck.com/...ows-maintenance-installer-dll-injection third-party-advisory

cve.org (CVE-2024-13976)

nvd.nist.gov (CVE-2024-13976)

Download JSON