Information Disclosure Vulnerability in NASA cFS Software
CVE-2026-67972

7.5HIGH

Key Information:

Vendor

NASA

Status
cFS
Vendor
CVE Published:
3 August 2026

What is CVE-2026-67972?

The CF_CFDP_RecvMd() component within NASA's cFS version 7.0.1 has a vulnerability that allows attackers to manipulate the storage of received content and data. This weakness may lead to unauthorized access to sensitive information, posing significant risks to data integrity and confidentiality. Users of this software are advised to review their security measures and implement the necessary updates to mitigate potential security threats.

References

https://github.com/nasa/cFS
https://github.com/nasa/cFS/issues/1073

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.