Intel TDX MigTD CVE-2026-60071

Exploitation requires local access to the platform plus high/privileged system-software rights - per the description, a 'System software adversary with a privileged user,' i.e. control at the hypervisor/VMM layer that can send vsock packets to the MigTD. The specific condition is the MigTD vsock packet-handling path with an improperly validated specified-quantity field (CWE-1284). Limiting factors: this is not remotely or unauthenticated reachable (AV:L, PR:H), requires no user interaction (UI:N), and only applies in Intel TDX deployments actually running a Migration Trust Domain; impact is limited to denial of service of the MigTD (availability), with no confidentiality or integrity effect and no spillover to other systems.

This is a medium-severity, availability-only denial-of-service issue (CVSS 4.0 base 6.7) whose real-world priority is moderate at best. The CVSS 4.0 vector is internally consistent and self-limiting: AV:L means the attacker must already have local access to the platform, PR:H means they must already hold high/privileged rights (the description frames this as a 'System software adversary with a privileged user'), and impact is confined to availability of the MigTD itself (VC:N/VI:N/VA:H) with no onward subsequent-system impact (SC:N/SI:N/SA:N). So the attacker essentially needs privileged control of the hypervisor/system-software layer to crash a Migration Trust Domain - a high bar. Exploitation signals are weak-to-absent: no CISA KEV listing, no PoC or exploit reference in the input, and no EPSS score was supplied, so exploitation probability cannot be quantified. The vendor priority label is 'this_month' (not act_now/emergency), consistent with a patch-this-cycle rather than drop-everything posture. Net: a genuine but low-urgency hardening fix, not a high-CVSS-but-overhyped item nor an active threat - the combination of local vector, high privilege requirement, and availability-only confidential-computing-niche impact keeps real-world risk contained. Missing data to note explicitly: EPSS is absent (cannot confirm low vs. unknown exploitation likelihood), and the CPE vendor field is the placeholder 'n/a' even though this is unambiguously an Intel product.

A system-software-level adversary already holding privileged access to the hypervisor (for example a malicious or compromised host/VMM operator) sends malformed vsock packets with an improperly validated specified-quantity field to the Intel TDX Migration Trust Domain. The MigTD mishandles the quantity during vsock packet handling and crashes, denying the migration service for confidential guests. No public exploit is identified at time of analysis, and the precise trigger mechanics beyond 'improper validation of specified quantity' are not described in the available sources.