Intel TDX MigTD
CVE-2026-55709
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local platform access
-
DeliveryInvoke MigTD GetQuote interface
-
ExploitReach loop with unreachable exit
-
ExecutionMigTD hangs (infinite loop)
-
ImpactDenial of service of attestation/migration path
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a TDX-enabled platform and the ability to invoke MigTD's GetQuote function within the Migration Trust Domain (Ring 0 / hypervisor context); no authentication or user interaction is needed (PR:N/UI:N/AT:N) and complexity is low (AC:L). The primary limiting factor is the local attack vector (AV:L) - the adversary must already be system-software-level/local to the platform, so this is not remotely exploitable over a network. Impact is confined to availability (DoS of the MigTD GetQuote/attestation path); there is no confidentiality or integrity impact and no subsequent-system (scope) impact. The specific crafted input that reaches the unreachable exit condition is not described in the available sources. |
| Impact | This is a moderate-severity availability-only issue, correctly rated medium (CVSS 4.0 base 6.9). The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) describes a local attack vector with low complexity, no attack requirements, no privileges and no user interaction, with impact limited to availability (VA:H) - confidentiality and integrity are explicitly None, and there are no subsequent-system impacts. This aligns with CWE-835 (infinite loop) in the MigTD GetQuote path: a hang/denial of service, not code execution or data exposure. No EPSS score is provided in the input, and there is no CISA KEV listing and no PoC reference, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a locally-exploitable DoS rather than a remotely wormable flaw. The key limiting signal is AV:L: despite PR:N (unauthenticated), exploitation requires local access to the platform / the hypervisor-adjacent MigTD context, which substantially narrows real-world exposure. One point to verify: the input CPE lists the vendor as 'n/a' even though the advisory is an Intel Security Center advisory (INTEL-SA-01580) - the product is unambiguously Intel's, so the 'n/a' vendor is a data artifact, not a genuine ambiguity. |
| Exploit ScenarioDerived | An adversary with local/system-software access to a TDX-enabled platform drives the MigTD GetQuote interface with input that reaches the vulnerable loop, causing MigTD to spin on an unreachable exit condition and hang. Because MigTD mediates migration-time attestation for Trust Domains (Ring 0 / hypervisor context), the hang denies the quote/attestation service and produces a denial of service. No public exploit is identified at time of analysis, and the exact triggering input is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 10, 2026
A denial-of-service condition exists in Intel's TDX Migration Trust Domain (MigTD), where the GetQuote routine contains a loop with an unreachable exit condition (CWE-835) and can therefore hang indefinitely. The flaw affects TDX-enabled platforms running MigTD in the Ring 0 hypervisor context; exploiting it requires local access with low complexity, no authentication and no user interaction (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N), so it is not remotely reachable. Impact is availability-only - the MigTD GetQuote/attestation path can be stalled - with no confidentiality, integrity or scope consequences; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though Intel has published advisory intel-sa-01580.
RemediationAI
Apply the fixed MigTD build identified in Intel security advisory intel-sa-01580 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html); the supplied evidence does not list an exact fixed version string, so the version must be confirmed from that advisory rather than assumed. Because the trigger requires local system-software-level access and only affects the MigTD GetQuote/attestation path, reducing who can invoke MigTD quote operations and confining hypervisor/system-software administrative access to trusted operators limits exposure, with the trade-off that attestation-dependent migration workflows are unavailable to the restricted principals. Where the advisory confirms no patched build is yet deployable for a given platform, delaying or disabling TDX migration operations that invoke MigTD GetQuote avoids the stall at the cost of losing seamless migration capability; reintroduce those operations once the vendor fix is installed. No public exploit code has been identified at time of analysis, so exploitation-driven emergency measures are not indicated, but the advisory should be tracked for updated fixed-version guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MigTD is the Migration Trust Domain component of Intel Trust Domain Extensions (TDX), the confidential-computing architecture that lets workloads run in hardware-isolated trust domains on Intel Xeon platforms. It executes at a system-software privilege level (Ring 0 / hypervisor context) and handles migration-related operations including quote generation for attestation. The root cause is CWE-835, a loop with an unreachable exit condition - sometimes termed an infinite loop - in the GetQuote path, meaning that when the loop's termination condition is never satisfied the routine does not return and the calling context stalls. The precise input or state that reaches this unreachable exit condition is not described in the available sources. Per CPE data the affected product is recorded as Intel(R) TDX Migration Trust Domain (MigTD) with no additional version granularity supplied, and no further library or protocol detail is given in the reference beyond Intel security advisory intel-sa-01580.
Know when Intel R Tdx Migration Trust Domain Migtd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local system-software access with no auth or interaction (AV:L/PR:N/UI:N), low complexity, scope unchanged (no subsequent-system impact), and availability-only DoS from an infinite loop (A:H; C/I:N).
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
DescriptionCVE.org
Loop with unreachable exit condition ('infinite loop') in the MigTD's GetQuote for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. System software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Missing authentication in the Intel TDX Migration Trust Domain (MigTD) SPDM rebind path allows an unauthenticated attack
Authentication bypass in the Intel TDX Migration Trust Domain (MigTD) rebinding protocol allows a privileged local adver
Capture-replay authentication bypass in Intel TDX Migration Trust Domain (MigTD) lets a local, highly privileged system-
Insufficient access-control granularity in the MigTD v2 policy evaluation engine within Intel TDX's Migration Trust Doma
Information disclosure in Intel's TDX Migration Trust Domain (MigTD) lets a network-reachable adversary read data that s
Privilege escalation and information disclosure in Intel TDX MigTD stem from an expired-pointer dereference in the virti
Write-what-where in the Intel TDX Migration Trust Domain (MigTD) lets a privileged local adversary who already holds Rin
Privilege escalation in Intel TDX's Migration Trust Domain (MigTD) allows an adversary who already controls the Ring 0 h
Privilege escalation in the Intel TDX Migration Trust Domain (MigTD) signing path allows a privileged local system-softw
Use-after-free in the MigTD virtio driver, a Ring 0 component of the Intel TDX Migration Trust Domain used during trust-
Local information disclosure in Intel MigTD, the Intel TDX Migration Trust Domain component operating in the Ring 0/hype
Integrity-only privilege escalation in the SPDM responder of Intel's TDX Migration Trust Domain (MigTD), caused by incom
GitHub PoC
Exploit-DB