Intel TDX MigTD CVE-2026-59771

Exploitation requires a local, high-privilege position: specifically a 'system software adversary with a privileged user' - in practice a malicious or compromised hypervisor that controls the virtio-serial device backend exposed to the Intel TDX MigTD. The trigger is an improperly validated array index (CWE-129) in the MigTD's virtio-serial driver; the exact crafted input is not described in the available sources. Limiting factors: the vector is local only (AV:L, no remote/network path), it demands high privileges (PR:H) rather than any unauthenticated access, no user interaction is required (UI:N), and the only achievable outcome is denial of service (availability) - there is no confidentiality or integrity impact and no scope change to other systems. It applies only to deployments actually running Intel TDX with the MigTD migration component.

This is a genuinely medium-tier issue, not an urgent priority. The only impact is availability (VA:H / A:H) - a denial of service of the Intel TDX Migration Trust Domain (MigTD); confidentiality and integrity are explicitly rated None, and there is no scope change to subsequent systems (SC/SI/SA:N). The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) describes a local, low-complexity attack that REQUIRES high privileges (PR:H): the threat model is a 'system software adversary with a privileged user,' i.e. a malicious or compromised hypervisor that already controls the virtio-serial backend presented to the MigTD. No EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The Intel decision/priority label is 'this_month' rather than act_now/emergency, consistent with a privileged-attacker, availability-only flaw. The one nuance worth flagging: for confidential computing, a hostile hypervisor is precisely the in-scope adversary, so PR:H here does not mean 'trusted insider' - it means an untrusted-but-privileged host, which is the realistic attacker TDX is meant to defend against. Even so, the ceiling is a DoS of the migration path, not a confidentiality break of the trust domain.

A malicious or compromised hypervisor, acting as the privileged host backing the MigTD's virtio-serial device, supplies a crafted descriptor with an out-of-bounds array index (CWE-129) that the MigTD driver fails to validate. This triggers a crash/hang of the Migration Trust Domain, disrupting or denying TD live-migration. No public exploit code is identified; the specific triggering input is not described in the available sources beyond 'improper validation of array index.'