Intel TDX MigTD CVE-2026-61469

Exploitation requires a local, Ring-0 / hypervisor-level system-software adversary that can invoke the MigTD vmcall_raw transport interface - i.e., the attacker must already control the host hypervisor interacting with an Intel TDX Migration Trust Domain. The CVSS vector (AV:L, AT:N, PR:N, UI:N) indicates no additional attack requirements, no authentication enforced by the transport, and no user interaction once that local position is held. Limiting factors: the vulnerability is only reachable on Intel TDX-enabled platforms running MigTD, the attack vector is local rather than network-reachable, and impact is bounded to low integrity and low availability (data corruption / denial of service) with no confidentiality loss and no subsequent-system impact.

Signals are mostly aligned toward moderate, not urgent, risk. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) describes a locally-accessed, low-complexity, unauthenticated flaw with only low integrity and low availability impact to the vulnerable system and no subsequent-system impact (VC:N/VI:L/VA:L/SC:N/SI:N/SA:N), yielding a base score of 5.1 (medium). The vuln.today decision label is 'this_month' - a routine patch-cycle priority, not act_now or emergency. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; absence of these is not itself a risk signal but does lower urgency. The key constraint is the local attack vector: exploitation requires a system-software adversary already positioned at Ring 0 / hypervisor level, so this is a trust-boundary hardening issue within the TDX confidential-computing model rather than a remotely reachable or mass-exploitable vulnerability. One point to verify with the vendor: the description's phrasing ('System software adversary with an unauthenticated user') maps PR:N despite the attacker needing hypervisor-level positioning - the 'unauthenticated' metric reflects that the MigTD transport imposes no additional authentication, not that any remote user can reach it. The CWE-193 off-by-one aligns with the low integrity/availability impact (bounded memory corruption / denial of service) rather than code execution.

A malicious or compromised hypervisor interacts with a Migration TD through the vmcall_raw transport and supplies input that trips the off-by-one boundary error, corrupting a small amount of adjacent data or crashing the MigTD. Because the vector is local (AV:L) and low-complexity (AC:L) with no authentication required by the transport, a Ring-0 adversary already present on the host can trigger it reliably. No public exploit code or PoC is identified in the available sources.