Intel MigTD CVE-2026-63028

Requires a local 'system software' adversary - specifically the untrusted hypervisor/VMM - able to interact with an Intel TDX Migration TD (MigTD) over its virtio-vsock stream interface; the defect lies in improper initialization within that stream-handling path. Preconditions that limit real-world exposure: the platform must be an Intel TDX-capable system actually running MigTD with TD migration enabled, and the attacker must already occupy the local host/VMM position (AV:L) - there is no remote/network attack path. No authentication or user interaction is required within that model (PR:N/UI:N) and complexity is low (AC:L), but impact is confined to low integrity and low availability of MigTD, with no confidentiality impact and no scope change to other systems.

This is a medium-severity, local-only defect (CVSS 4.0 base 5.1) in a narrow confidential-computing component, and the signals are internally consistent rather than conflicting. The vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N describes a local attacker (AV:L) with no special privileges in the TDX threat model (PR:N) and low attack complexity (AC:L), producing only low integrity and low availability impact on the MigTD itself and no confidentiality impact and no subsequent-system (scope) impact. The 'PR:N / unauthenticated' reading must be understood in context: in the Intel TDX trust model the 'system software adversary' is the untrusted hypervisor/VMM, so AV:L reflects that the adversary is co-resident host software rather than a remote network attacker - this is not a remotely exploitable flaw. No EPSS score, no CISA KEV listing, and no proof-of-concept were supplied in the input, so there is no evidence of active or probable exploitation; the only reference is the Intel vendor advisory (INTEL-SA-01580). The vuln.today decision label is 'this_month', i.e. a scheduled-remediation priority, not an emergency. Net assessment: a genuine but bounded issue - real enough to patch on a normal cycle for TDX/MigTD operators, but not a widespread-exploitation emergency. Missing data to note explicitly: EPSS probability is absent (cannot quantify exploitation likelihood) and no CWE-level trigger detail is given beyond 'improper initialization', so the exact corruption mechanism is not described in the available sources.

A malicious or compromised hypervisor/VMM (the untrusted system software in the TDX model) interacts with a Migration TD over the virtio-vsock stream interface during TD live migration and drives the improperly initialized stream-handling path, causing data corruption within MigTD or a denial of service of the migration component. Because the attacker is already the local host software and no authentication or user interaction is required (AV:L/AC:L/PR:N/UI:N), the interaction is straightforward, but impact is limited to low integrity/availability of MigTD. No public exploit identified at time of analysis.