Intel MigTD CVE-2026-61470

Exploitation requires the target to be running the Intel TDX Migration Trust Domain (MigTD) with its TLS client active, i.e. an Intel TDX-enabled hypervisor environment performing or supporting trust-domain migration. The attacker must hold an adjacent network position (AV:A) relative to that MigTD TLS client - remote internet-only access is NOT sufficient - but once adjacent, no authentication (PR:N), no user interaction (UI:N), and only low attack complexity (AC:L, AT:N) are needed. Limiting factors: the adjacency requirement sharply narrows the attacker population, impact is capped at low integrity and low availability (DoS / limited data corruption) of the MigTD itself with no confidentiality loss and no subsequent-system impact, and the component is only present where Intel TDX migration is deployed.

This is a moderate-severity issue (CVSS 4.0 base 5.3) that should be treated as routine rather than emergency patching, consistent with the vuln.today 'this_month' decision label. The CVSS 4.0 vector tells a coherent, low-urgency story: the attack vector is AV:A (adjacent, NOT network), meaning the adversary must already occupy the same logical/local network segment as the MigTD TLS client rather than reaching it from the open internet, while AC:L/AT:N/PR:N/UI:N indicate that, given that adjacency, exploitation is low-complexity, unauthenticated, and needs no user interaction. The impact is deliberately bounded - VC:N/VI:L/VA:L (no confidentiality loss, only low integrity and low availability impact) with no subsequent-system impact (SC/SI/SA all N) - so the realistic worst case is a denial of service or limited data corruption confined to the MigTD component, not host or guest compromise. No EPSS score, KEV entry, or PoC was supplied, so there is no evidence of active or imminent exploitation. The signals are internally consistent (no CVSS-vs-description conflict), but note the description's phrase 'Network adversary' is reconciled by the vector as adjacent-only - defenders should not read this as internet-exposed. Overall: a real but low-priority hardening item, driven by severity rather than demonstrated exploitation.

An attacker positioned on a network adjacent to a host running Intel TDX Migration Trust Domain interacts with the MigTD TLS client during trust-domain migration and sends traffic that triggers the improper resource-lifetime handling (CWE-664). Because the flaw is low-complexity and unauthenticated, this can corrupt limited data or deny the MigTD service without user interaction. No public exploit identified at time of analysis; the exact trigger is not described in the available sources.