Intel TDX MigTD CVE-2026-60133

Exploitation requires local access (AV:L) to a system running the Intel TDX Migration Trust Domain (MigTD) and an authenticated low-privileged account (PR:L); the attack surface is the MigTD vsock interface. Realistic exposure is limited to environments actually using TDX trust-domain live migration, which is a narrow deployment mode. Limiting factors: high attack complexity (AC:H) means the attacker must rely on conditions not fully under their control to trigger the integer overflow; no user interaction is needed (UI:N), but the ceiling is denial of service only (VA:H, VI:L) with no confidentiality or subsequent-system impact. The exact trigger is not described in the available sources - verify against Intel-SA-01580.

This is a moderate-severity, low-urgency issue rather than a top priority. The Intel-assigned CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N) scores 5.8 and describes a locally-exploitable denial of service requiring an authenticated, low-privileged adversary and a high-complexity attack; impact is limited to integrity (low) and availability (high) of the MigTD itself, with no confidentiality impact and no subsequent-system (scope) impact. There is no EPSS score, no CISA KEV listing, and no public exploit in the supplied data, so all exploitation signals point to theoretical rather than active risk. The vuln.today decision label is 'this_month,' consistent with a patch-on-normal-cadence item, not an emergency. The main caveat is that AC:H (high attack complexity) and AV:L (local) are severity metrics only - the supplied Intel advisory reference was not retrieved, so the exact trigger and the real-world conditions under which the integer overflow fires are not described in the available sources and should be confirmed against Intel-SA-01580.

An authenticated, low-privileged software adversary with local access to a system running the Intel TDX Migration TD interacts with the MigTD vsock interface in a way that triggers an integer overflow (CWE-190), crashing or hanging the MigTD and denying the trust-domain migration service. The high attack complexity implies the attacker must satisfy conditions outside their direct control to reliably trigger the overflow. No public exploit code is identified at time of analysis.