Intel MigTD CVE-2026-57893

Exploitation requires an attacker already holding privileged system-software access (PR:H) - a privileged/hypervisor-level adversary as the description states ('System software adversary with a privileged user') - positioned for adjacent access (AV:A) to the MigTD's SPDM responder, specifically exercised during the TDX migration trust-domain / SPDM negotiation path. Limiting factors that reduce real-world risk: it is NOT remotely or unauthenticated exploitable (PR:H, AV:A rules out AV:N and PR:N), it is confined to deployments that actually use Intel TDX confidential VMs with migration (MigTD) enabled, and impact is limited to integrity/data corruption with no confidentiality or availability loss. No user interaction is required (UI:N), and no special internal knowledge or specific attack requirements are needed (AT:N, AC:L) once the privileged adjacent foothold exists.

This is a medium-severity (CVSS 4.0 base 6.8), integrity-only escalation-of-privilege flaw in the SPDM responder of Intel's TDX Migration Trust Domain (MigTD), rooted in incomplete internal state distinction (CWE-372). The supplied CVSS vector (AV:A/AC:L/AT:N/PR:H/UI:N) is the dominant signal and it tempers the risk considerably: exploitation requires an already-privileged system-software adversary (PR:H) operating from an adjacent position (AV:A), not a remote unauthenticated attacker. Impact is confined to integrity (VI:H / data corruption) with no confidentiality or availability loss and no subsequent-system impact (scope does not change). No EPSS score was provided, the CVE is not listed in CISA KEV, and no PoC or exploit reference is present - only the Intel vendor advisory. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real but non-urgent, high-privilege-prerequisite issue rather than a widely weaponized flaw. Net: a genuine priority for the narrow population running Intel TDX confidential-computing migration, but the high privilege requirement and adjacent vector make mass exploitation unlikely. Note: EPSS data is missing, so probabilistic exploitation likelihood cannot be cross-referenced against the other signals.

A system-software adversary who already controls a privileged component at the hypervisor/Ring 0 layer interacts with the MigTD's SPDM responder from an adjacent position during a TD migration exchange, abusing the responder's failure to fully distinguish its internal state to drive it into an unintended state and corrupt data, escalating privilege within the migration trust boundary. Exploitation is low-complexity (AC:L) once the privileged foothold exists and needs no user interaction. No public exploit code or PoC reference is identified at time of analysis.