Intel TDX MigTD
CVE-2026-60138
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessControl hypervisor/VMM (PR:H)
-
DeliverySend crafted virtio-vsock traffic to MigTD
-
ExploitTrigger out-of-range pointer offset
-
ExecutionCorrupt MigTD memory
-
ImpactEscalate privilege into migration trust domain
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Use after free prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a privileged system-software adversary - specifically control of the Ring 0 hypervisor/VMM - reaching the MigTD through its virtio-vsock implementation; it is the untrusted-hypervisor-versus-trust-domain boundary that TDX is meant to protect. CVSS is AV:L/AC:L/PR:H/UI:N: local vector, low complexity, no user interaction, but high privilege is mandatory, so this is not remotely or unauthenticated-exploitable. The limiting factor is deployment: only hosts running Intel TDX with the MigTD migration trust domain are affected, and the attacker must already occupy the privileged hypervisor position. The precise feature state or configuration that exposes the vulnerable virtio-vsock path is not detailed in the available sources. |
| Impact | Signals are moderately consistent and point to a genuine but constrained risk. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) describes a locally-reachable, low-complexity flaw requiring high privileges that fully compromises the MigTD's confidentiality, integrity and availability, which is why the base score lands at 8.4 (High). The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with the absence of a CISA KEV listing and no referenced proof-of-concept. No EPSS score was supplied, so statistical exploitation probability cannot be stated. The PR:H requirement is the key tempering factor: this is a trust-boundary bypass exploitable by a privileged 'system software adversary' (the hypervisor), not a remote unauthenticated issue - the attacker must already control the hypervisor/VMM layer to reach MigTD's virtio-vsock interface. For environments that actually deploy Intel TDX confidential computing this is a meaningful escalation-of-privilege concern worth patching on the vendor's stated timeline; for everyone else the affected component is not present. No conflicting signals were found in the input, but EPSS and POC status are simply missing rather than contradictory. |
| Exploit ScenarioDerived | A malicious or compromised hypervisor/VMM - the untrusted party that TDX is specifically designed to defend against - drives crafted traffic over the virtio-vsock channel into the MigTD, triggering the out-of-range pointer offset (CWE-823) to corrupt MigTD memory and escalate into the migration trust domain. Because the CVSS vector is AV:L/AC:L/PR:H/UI:N, no user interaction is needed and attack complexity is low, but the attacker must already hold the privileged system-software (hypervisor) position. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 10, 2026
Privilege escalation in Intel TDX's Migration Trust Domain (MigTD) allows an adversary who already controls the Ring 0 hypervisor/VMM to cross the isolation boundary that TDX is built to enforce, through an out-of-range pointer offset in MigTD's virtio-vsock implementation. Only hosts running Intel TDX with the MigTD migration trust domain are affected, and the vector is local with low attack complexity and no user interaction but requires high privilege (control of the hypervisor), so the high confidentiality, integrity and availability impact is reachable only from an already-dominant position. No public exploit code or active exploitation was identified in the available data, and the priority assessment places remediation in the current week.
RemediationAI
No vendor-released patch or fixed version is identified in the available data for this CVE, so the first step is to obtain the current fixed MigTD build and any version-specific guidance directly from Intel security advisory intel-sa-01580 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html); do not assume a build is fixed without confirming against that advisory. Because exploitation requires an attacker who has already achieved Ring 0 hypervisor/VMM control and can reach MigTD over virtio-vsock, the practical containment available from the supplied information is to keep host hypervisor and VMM privileged access tightly restricted and monitored, and to limit which hosts run TDX migration with MigTD enabled until a fixed build is applied - noting that these measures reduce exposure and detection surface but do not remove the underlying out-of-range pointer offset, and that disabling TDX migration trades away the availability and operational benefits of live confidential-workload migration. Remediation is prioritized for the current week according to the vulnerability priority assessment.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-823, Use of Out-of-range Pointer Offset, in the virtio-vsock component of Intel's Migration Trust Domain. virtio-vsock is the paravirtualized socket transport through which MigTD communicates, and in the TDX threat model the hypervisor/VMM is explicitly untrusted with respect to the trust domain - MigTD is the code that mediates migration of confidential workloads across that boundary. An offset that is not validated against the bounds of the referenced object allows a memory access outside the intended range, giving the hypervisor-side attacker a path to memory corruption and privilege escalation out of the position it already occupies. The advisory places the issue in Ring 0 (hypervisor) context, which matches the assessed prerequisites: exploitation requires a privileged system-software adversary with hypervisor/VMM control, low attack complexity, no user interaction and a local vector. The available sources do not describe the precise trigger, the exact virtio-vsock feature state or configuration that exposes the vulnerable path, or whether specific MigTD builds differ, so those details remain unverified.
Know when Intel R Tdx Migration Trust Domain Migtd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local vector with low complexity but a privileged hypervisor attacker (PR:H); scope unchanged since impact stays within MigTD (S:U), with full C/I/A loss of the trust domain.
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
DescriptionCVE.org
Use of out-of-range pointer offset in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Executive ViewAI
A high-severity privilege escalation flaw in Intel TDX's Migration Trust Domain (MigTD) undermines the hardware isolation boundary that confidential-computing workloads rely on to protect guest data. Organizations running Intel TDX with MigTD on their virtualization estates face potential exposure of confidential workload data, but only from an attacker who has already fully compromised the hypervisor - meaning the vulnerability amplifies an existing breach rather than opening a new door. Leadership should care because it erodes the core trust guarantee of TDX deployments and therefore any compliance or customer assurances tied to confidential computing.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict hypervisor (Ring 0) administrative access to the smallest possible set of trusted operators with strong MFA and session monitoring; disable or isolate MigTD-based live migration on sensitive TDX hosts where feasible; apply latest Intel microcode/firmware updates and monitor Intel advisories for a fix; and enhance logging/detection around migration workflows and virtio-vsock activity to catch post-compromise escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Affected Products (CPE)CVE.org
Missing authentication in the Intel TDX Migration Trust Domain (MigTD) SPDM rebind path allows an unauthenticated attack
Authentication bypass in the Intel TDX Migration Trust Domain (MigTD) rebinding protocol allows a privileged local adver
Capture-replay authentication bypass in Intel TDX Migration Trust Domain (MigTD) lets a local, highly privileged system-
Insufficient access-control granularity in the MigTD v2 policy evaluation engine within Intel TDX's Migration Trust Doma
Information disclosure in Intel's TDX Migration Trust Domain (MigTD) lets a network-reachable adversary read data that s
Privilege escalation and information disclosure in Intel TDX MigTD stem from an expired-pointer dereference in the virti
Write-what-where in the Intel TDX Migration Trust Domain (MigTD) lets a privileged local adversary who already holds Rin
Privilege escalation in the Intel TDX Migration Trust Domain (MigTD) signing path allows a privileged local system-softw
A denial-of-service condition exists in Intel's TDX Migration Trust Domain (MigTD), where the GetQuote routine contains
Use-after-free in the MigTD virtio driver, a Ring 0 component of the Intel TDX Migration Trust Domain used during trust-
Local information disclosure in Intel MigTD, the Intel TDX Migration Trust Domain component operating in the Ring 0/hype
Integrity-only privilege escalation in the SPDM responder of Intel's TDX Migration Trust Domain (MigTD), caused by incom
GitHub PoC
Exploit-DB