Intel MigTD CVE-2026-60142

Exploitation requires an attacker who is already a privileged system-software adversary (PR:H) with local access (AV:L) to a host running the Intel TDX Migration Trust Domain (MigTD) - concretely, control at the Ring 0 / hypervisor level as the description states, interacting with the MigTD during TD migration. AC:L/AT:N/UI:N mean that once this privileged local position is held, no special internal knowledge, no additional attack requirement, and no user interaction are needed. The principal limiting factors are therefore: the target must deploy Intel TDX with migration (MigTD) enabled, and the attacker must already possess high-privilege host/system-software access rather than guest or network access - the trigger mechanism beyond the CWE-123 write-what-where classification is not described in the available sources.

This is a genuine but access-gated priority rather than a mass-exploitation threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N, score 8.4) and the description agree on the mechanism: a privileged 'system software adversary' - an entity operating at Ring 0 / hypervisor level - can trigger a write-what-where condition (CWE-123) in the Intel TDX Migration Trust Domain (MigTD) to achieve information disclosure and escalation of privilege. The high rating comes from full VC/VI/VA (confidentiality, integrity, availability) impact to the vulnerable system, consistent with the security value of the TDX trust boundary the MigTD is meant to protect, not from reachability - PR:H and AV:L mean the attacker must already hold privileged local/host-software access. No EPSS score was provided, the vulnerability is not in CISA KEV, and no public exploit or PoC reference is present, so there is no evidence of active or widespread exploitation; the vuln.today 'this_week' decision label reflects a to-be-patched priority rather than emergency active exploitation. Net: a serious confidential-computing trust-boundary flaw that matters acutely to cloud/host operators running Intel TDX, but it is constrained by the high-privilege local prerequisite and shows no exploitation signal. One cross-signal note: the SC/SI/SA = None values mean Intel does not assess a scope change into a separate system despite the privilege-escalation framing - the escalation is understood as occurring within the TDX/MigTD trust context.

A malicious or compromised host hypervisor/VMM (the privileged system-software adversary described) abuses the write-what-where condition in the MigTD during trust-domain migration handling to write attacker-chosen data to an attacker-chosen location, disclosing protected TD state and escalating privilege across the MigTD trust boundary. Because AC:L/AT:N, no special timing or additional attack requirement is needed once the privileged local position is held. No public exploit or PoC is identified at time of analysis, so this scenario is inferred from the CVSS vector and CWE-123 rather than demonstrated code.