Intel TDX MigTD CVE-2026-56759

Exploitation requires a local, privileged system-software adversary (an untrusted or compromised hypervisor operating at Ring 0) that can feed attacker-controlled PCI Base Address Register (BAR) values into the Intel TDX Migration Trust Domain (MigTD); the flaw is in MigTD's handling/validation of those PCI BAR inputs. Limiting factors: the attack is local only (AV:L, no network reachability), demands high privileges (PR:H) rather than any unprivileged user, and its impact is confined to integrity/data corruption of the MigTD - there is no confidentiality or availability impact and no subsequent-system impact. It is only relevant where Intel TDX with the Migration Trust Domain is actually deployed, so hosts not running TDX migration are unaffected. No user interaction is required (UI:N).

This is a medium-severity (CVSS 4.0 base 6.7), integrity-only flaw whose real-world priority is moderate, not urgent. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N) describes a locally-exploitable, low-complexity attack that requires high privileges and no user interaction, affecting only integrity (high) of the vulnerable system with no confidentiality, availability, or subsequent-system impact - consistent with the description's 'privileged user' and 'data corruption' language. The PR:H requirement is the key risk limiter: in the Intel TDX threat model the attacker here is the untrusted system software / hypervisor (Ring 0), so 'high privileges' is the expected adversary position rather than a meaningful barrier, which is why this is categorized as an escalation-of-privilege / confidential-computing isolation breach rather than a conventional privilege-gated bug. No EPSS score, KEV listing, POC, or SSVC automatable/technical-impact fields were provided in the input, so exploitation probability cannot be quantified from the data. The vuln.today priority is 'this_month' (not act_now/emergency). Net: there is no public exploit identified at time of analysis and the local/high-privilege vector plus niche footprint keep mass-exploitation risk low, but for TDX confidential-computing deployments the integrity breach of the trusted MigTD is architecturally significant and should be patched on the stated timeline. EPSS and KEV data are absent - treat exploitation likelihood as unknown rather than low.

A malicious or compromised hypervisor (system-software adversary already holding Ring 0 / privileged access on a TDX host) supplies malformed PCI BAR data that the MigTD fails to validate properly, corrupting MigTD state or memory and undermining the integrity guarantees of the Migration Trust Domain. The attack is local and low-complexity with no user interaction, but requires the privileged hypervisor position; no public exploit code is identified at time of analysis.