CVE-2026-67972 describes a vulnerability in the CF_CFDP_RecvMd() component of NASA's Core Flight System (cFS) version 7.0.1. The flaw allows an attacker to influence the storage location of received content and data, which may result in unauthorized information disclosure. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and confidentiality impact rated high (C:H). No integrity or availability impacts are noted. There is no information about available patches or fixes at this time.

Successful exploitation could allow an attacker to control where received data is stored, potentially exposing sensitive information. The confidentiality impact is high, but there is no impact on integrity or availability. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor official NASA cFS advisories for updates. No specific mitigations are provided in the current data.