Intel TDX Guest CVE-2026-20763

Exploitation requires local access to a system running Intel TDX Guest software prior to version 0.3.1 on Intel TDX-capable hardware (Sapphire Rapids or later), combined with a high-privilege account within the guest OS - described explicitly as a 'system software adversary with a privileged user.' No user interaction, no specialized internal knowledge (AT:N per CVSS 4.0), and no non-default configuration are required beyond that privileged foothold. The vulnerability is bounded to intra-guest privilege escalation: subsequent-system impacts are rated None across confidentiality, integrity, and availability, meaning exploitation cannot break out to the host hypervisor or affect co-resident trust domains. Limiting factors that reduce real-world exploitability: requires physical or authenticated local session with high privileges, affects only deployments using Intel TDX hardware and this specific guest software stack, and produces only low-level C/I/A impact within the guest - not a full domain compromise.

The CVSS 4.0 score of 4.6 (Medium) accurately reflects a tightly scoped vulnerability: the local attack vector (AV:L) and high privileges required (PR:H) confine the threat to adversaries who already hold elevated access inside a running TDX guest. Low impact ratings across Confidentiality, Integrity, and Availability (VC:L/VI:L/VA:L) and zero subsequent-system impact (SC:N/SI:N/SA:N) confirm that exploitation cannot cascade from the guest to the host or hypervisor - the primary security boundary TDX is designed to enforce remains intact. No EPSS data was included in the intelligence feed; without it, exploitation probability cannot be quantified, though the high-privilege prerequisite strongly suppresses opportunistic risk. No CISA KEV listing and no public proof-of-concept exist at time of analysis. The description's framing - 'system software adversary with a privileged user' - points to insider-threat or compromised-privileged-account scenarios within confidential computing deployments. For any organization not running TDX workloads on Sapphire Rapids or later hardware with this specific guest software, the vulnerability has zero applicability. The CVSS score and impact ratings are internally consistent with the description; no conflicting signals were identified across the available data sources.

A privileged user or compromised high-privilege account within an Intel TDX guest virtual machine crafts an operation that triggers the incorrect calculation in Ring 3 TDX guest software, producing an exploitable state that allows privilege escalation within the trust domain. No public proof-of-concept exists at time of analysis, and the requirement for pre-existing high-privilege access makes opportunistic or remote exploitation infeasible. The realistic threat actor is a malicious insider or an attacker who has already achieved privileged access within a confidential computing workload and seeks to expand beyond their authorized privilege level.