Commvault DLL Injection Vulnerability in Windows Maintenance Installer

A DLL injection vulnerability has been identified in Commvault versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0 for Windows. This vulnerability allows an attacker with local access to exploit uncontrolled search path or DLL loading behavior during the installation of maintenance updates, potentially leading to arbitrary code execution with elevated privileges.

Impact

Exploitation of this vulnerability allows for DLL injection, enabling local attackers to execute arbitrary code with elevated privileges.

Remediation

Users can upgrade to Commvault versions 11.20.202, 11.28.124, 11.32.65, 11.34.37, or 11.36.15 to address this vulnerability.