Intel MigTD CVE-2026-61377

Exploitation requires a privileged system-software adversary - per the description, a 'system software adversary with a privileged user,' consistent with PR:H and the Ring 0 / hypervisor context - operating with local access (AV:L) against a host running Intel TDX with the Migration Trust Domain (MigTD) component active for TD live migration. The flaw is sensitive information left uncleared in a resource before it is released for reuse (CWE-226), so a successful read depends on that residual data being present and reachable during the migration workflow. Limiting factors are substantial: high attack complexity (AC:H), the requirement for high privileges, local-only access with no remote vector, and the need for a deployment that actually uses TDX migration via MigTD; no user interaction is required (UI:N). The specific trigger mechanism for the resource reuse is not described in the available sources.

This is a medium-severity information-disclosure flaw (CVSS 4.0 base 6.8) in Intel's MigTD, the Migration Trust Domain component that brokers live migration of Intel TDX confidential-computing workloads. The vendor's own CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H) tells a consistent, low-urgency story: exploitation requires local access, high attack complexity, and high privileges - specifically a 'system software adversary with a privileged user,' i.e. a malicious or compromised Ring 0 hypervisor. No EPSS score, no CISA KEV listing, and no public exploit were supplied, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the scheduled-patching posture that the combination of PR:H + AC:H + local-only vector implies. The signals do not conflict: a high-privilege, high-complexity, local-only bug against a narrowly deployed confidential-computing component is a real but non-urgent confidentiality risk, not a high-CVSS-but-overstated issue nor an actively exploited emergency. The practical concern is specific - a privileged hypervisor could read residual secret material (per CWE-226, sensitive data not cleared from a resource before reuse) that TDX is explicitly designed to shield from that same hypervisor, partially eroding the TDX trust boundary.

A malicious or compromised Ring 0 hypervisor operator with privileged access to a host running Intel TDX with MigTD attempts a high-complexity, local attack to read sensitive data that MigTD failed to clear from a reused resource before release. Because integrity and availability are unaffected, the goal is purely disclosure of confidential material crossing or held by the migration trust domain. No public exploit code was provided, and the high attack complexity indicates the trigger conditions are not reliably attacker-controlled.