Intel R Tdx Migration Trust Domain Migtd
Monthly
Privilege escalation and information disclosure in Intel TDX MigTD stem from an expired-pointer dereference in the virtio-vsock implementation, reachable by a malicious or compromised hypervisor holding Ring 0 control. The issue is local (AV:L) and requires high privileges (PR:H) but is low complexity with no attack requirements or user interaction, and successful exploitation can result in high impact to confidentiality, integrity, and availability of the TDX system while leaving subsequent systems unaffected; no public exploit was identified at time of analysis.
Missing authentication in the Intel TDX Migration Trust Domain (MigTD) SPDM rebind path allows an unauthenticated attacker on an adjacent network to escalate privileges, disclose information and potentially achieve remote code execution on hosts engaged in Trust Domain migration. The flaw is scored 9.4 under CVSS 4.0 and carries a scope-change vector (AV:A/AC:L/PR:N/UI:N/S:C) with high confidentiality, integrity and availability impact to the vulnerable component and to subsequent systems. No public exploit code or CISA KEV entry is associated with it at time of analysis, and the priority label is act_now; the practical limit on exposure is reachability, since the attacker must sit on a logically adjacent path to a host that is actively using MigTD migration.
Capture-replay authentication bypass in Intel TDX Migration Trust Domain (MigTD) lets a local, highly privileged system-software adversary replay a legitimate migration-authentication exchange to escalate privilege in Ring 0 and compromise confidentiality and integrity; availability impact is none. Only environments running Intel TDX confidential-computing live migration with MigTD active are exposed, and the attacker needs a high-privilege hypervisor position plus local access, substantially narrowing the realistic attacker set. No CISA KEV entry or public exploit code is identified in the available data, though the issue is labeled act_now in priority intelligence.
Write-what-where in the Intel TDX Migration Trust Domain (MigTD) lets a privileged local adversary who already holds Ring 0/hypervisor-level control convert that position into high confidentiality, integrity and availability impact on TDX-enabled hosts, with potential information disclosure and escalation of privilege. Only platforms that deploy Intel TDX with MigTD-based migration are in scope, and the attacker must already sit at the system-software/hypervisor layer, so guest workloads and remote network attackers cannot reach the flaw on their own. No public exploit identified at time of analysis, and the vuln.today priority label 'this_week' reflects a genuine but access-gated issue rather than a mass-exploitation threat.
Privilege escalation in Intel TDX's Migration Trust Domain (MigTD) allows an adversary who already controls the Ring 0 hypervisor/VMM to cross the isolation boundary that TDX is built to enforce, through an out-of-range pointer offset in MigTD's virtio-vsock implementation. Only hosts running Intel TDX with the MigTD migration trust domain are affected, and the vector is local with low attack complexity and no user interaction but requires high privilege (control of the hypervisor), so the high confidentiality, integrity and availability impact is reachable only from an already-dominant position. No public exploit code or active exploitation was identified in the available data, and the priority assessment places remediation in the current week.
Insufficient access-control granularity in the MigTD v2 policy evaluation engine within Intel TDX's Migration Trust Domain allows a network adversary positioned on an adjacent network to achieve privilege escalation inside the Ring 0 (hypervisor) layer, with high confidentiality and integrity impact extending to subsequent systems. Exploitation requires the target to be running Intel TDX with MigTD v2 and its policy evaluation engine active, and while no authentication or user interaction is needed, the attack is rated high complexity and the specific trigger mechanism is not described in the available sources. No public exploit code or PoC reference was identified at time of analysis and the vulnerability is not in CISA KEV; the vendor advisory is Intel SA-01580.
Information disclosure in Intel's TDX Migration Trust Domain (MigTD) lets a network-reachable adversary read data that should stay inside the confidential-computing boundary: the SPDM responder does not properly clean up when an exception is thrown, and per the assessed vector the attacker needs no authentication, no special attack requirements and no user interaction (CVSS 4.0 base 8.7, confidentiality high, integrity and availability none). Real-world exposure is confined to hosts where Intel TDX with MigTD is deployed and the SPDM responder is reachable during a Trust Domain migration or attestation session, rather than general-purpose systems. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor (Intel) is the reporting source and the issue is prioritized as a this-week item rather than an emergency.
Privilege escalation in the Intel TDX Migration Trust Domain (MigTD) signing path allows a privileged local system-software adversary at the Ring-0/hypervisor level to abuse confused-deputy behavior and expand integrity and confidentiality impact across the TDX trust boundary. The flaw affects hosts running Intel TDX confidential computing with MigTD-based migration enabled; it is local-only, requires high existing privileges, and no public exploit code or KEV-listed active exploitation was identified at time of analysis. CVSS 8.2 reflects high integrity impact and scope change, not remote reachability.
Authentication bypass in the Intel TDX Migration Trust Domain (MigTD) rebinding protocol allows a privileged local adversary, such as a malicious or compromised Ring 0 hypervisor, to spoof rebinding traffic and escalate privileges, potentially enabling local code execution with high confidentiality, integrity, and availability impact on the vulnerable system and subsequent systems. Exposure is limited to platforms that use TDX live migration and the MigTD rebinding path; platforms not using TDX migration are not exposed. The vulnerability is local and requires high privileges (PR:H) rather than remote or unauthenticated access, and no public exploit has been identified at time of analysis, but the act-now priority reflects the low attack complexity once the privileged-local and MigTD preconditions are met.
Improper initialization in the virtio-vsock stream handling of the Intel TDX Migration Trust Domain (MigTD) lets a local system-software adversary - the untrusted hypervisor/VMM - drive the migration TD into a denial-of-service and low-integrity data-corruption condition. Exposure is narrowly scoped: the host must be an Intel TDX-capable platform that is actually running MigTD with TD migration enabled, and the attacker must already hold the local hypervisor position, so there is no remote attack path. CVSS 4.0 scores the issue 5.1 (AV:L/AC:L/AT:N/PR:N/UI:N, with low integrity and availability impact and no confidentiality or scope impact); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), placing it in a this-month remediation cadence rather than an emergency one.
Adjacent-network attackers can degrade availability of Intel TDX Migration Trust Domain (MigTD), the component that handles live migration of Trust Domains in Intel TDX confidential computing, through incorrect ordering of operations in the get_tcb_level_by_svn routine. The flaw is reachable without authentication (PR:N) and without user interaction (UI:N) from the migration fabric, but impact is limited to availability (A:L) with no confidentiality or integrity effect and no code execution. Exposure is confined to environments where Intel TDX with Trust Domain migration is actually deployed, and no public exploit has been identified at time of analysis; priority is assessed as this-month rather than emergency.
Intel TDX Migration Trust Domain (MigTD) contains an unchecked return value in its TLS implementation, classified CWE-252, that a network adversary can leverage for a denial of service against the migration agent. Affected deployments are those using TDX live migration with MigTD, where an unauthenticated attacker on an adjacent network segment can trigger the fault with low attack complexity and no user interaction; impact is confined to low integrity and low availability of MigTD itself, with no confidentiality or subsequent-system effects. No public exploit code or CISA KEV entry was identified in the available sources, and the vuln.today priority is 'this_month' rather than emergency, reflecting the adjacent-access precondition; the vendor advisory is Intel-SA-01580.
Local denial of service in Intel TDX's Migration Trust Domain (MigTD) affects platforms where TDX and MigTD-based live migration are enabled. A privileged system-software adversary who controls the hypervisor or ring-0 host can drive MigTD into an error path whose return value is not checked (CWE-252), causing availability impact with no confidentiality or integrity effect. The issue requires local access and high privileges, is rated medium severity (CVSS 4.0 base 6.7), and no CISA KEV listing or public exploit was identified at time of analysis.
Integrity-only privilege escalation in Intel TDX MigTD can let a privileged local adversary at Ring 0 abuse the vmcall_raw transport to corrupt the migration trust domain’s integrity, with no confidentiality or availability impact and no subsequent-system effect. The issue affects environments that actually deploy the Intel TDX Migration Trust Domain (MigTD) and requires a specific attack prerequisite (AT:P) in addition to high privilege and local access; the exact trigger is not described in the available sources. No public exploit was identified at time of analysis, and the medium-severity CVSS 4.0 score of 5.6 aligns with a this-month priority rather than emergency response.
CVE-2026-61470 is a lifetime-management flaw, classified as CWE-664 improper control of a resource through its lifetime, in the TLS client component of Intel's TDX Migration Trust Domain (MigTD), which runs at Ring 0 hypervisor level. An attacker who already holds an adjacent network position, with no authentication and no user interaction required, can exploit the low-complexity flaw to cause a denial of service and limited data corruption within the MigTD itself, with integrity and availability impact rated low and no confidentiality loss; only environments actually deploying Intel TDX migration with the MigTD TLS client active are exposed. It is scored 5.3 under CVSS 4.0 (and 5.3 in the independent CVSS 3.1 assessment) and vuln.today assigns it a 'this_month' priority, indicating routine rather than emergency patching; no public exploit code or confirmed active exploitation is identified in the available data.
An off-by-one error in Intel TDX MigTD's vmcall_raw transport can let a local Ring-0/hypervisor-level system-software adversary corrupt data or cause denial of service on TDX-enabled platforms running the migration trust domain. The CVSS 4.0 vector indicates local access, low attack complexity, no attack requirements, no authentication enforced by the transport, and no user interaction, with low integrity and availability impact and no confidentiality impact or subsequent-system impact. No public exploit was identified at time of analysis, and the issue is assessed as moderate rather than urgent risk.
Information disclosure in the logging path of the Intel TDX Migration Trust Domain (MigTD) lets an adversary who already controls Ring 0 system software - a compromised or malicious hypervisor with local access to the host - read confidential trust-domain data the logging code fails to protect. The root cause is improper privilege management (CWE-269) in MigTD logging rather than a memory-safety defect, and impact is confined to confidentiality with high severity for that one property; integrity and availability are unaffected and there is no scope change. Our re-assessment lands at medium severity (CVSS 3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) with low urgency, escalated only by the high privilege already required to reach the flaw. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; Intel has published advisory intel-sa-01580, and the vuln.today decision label is 'this_month'.
Use-after-free in the MigTD virtio driver, a Ring 0 component of the Intel TDX Migration Trust Domain used during trust-domain migration, allows a high-privileged local attacker to corrupt kernel memory and escalate privileges, with high integrity and low availability impact and no confidentiality impact. Only hosts running Intel TDX with the MigTD migration component are affected, and exploitation requires an already-privileged 'system software adversary' - effectively a malicious or compromised hypervisor/Ring 0 component - with local access and low attack complexity. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; it is assessed as a this-month patch item rather than an emergency.
Incorrect buffer-size calculation in Intel TDX Migration Trust Domain (MigTD)'s servtd_get_quote quote-retrieval path can allow a local adversary with hypervisor/Ring-0 system-software privileges to trigger a low-impact denial of service. Exploitation is constrained by high attack complexity and a required attack precondition, and no public exploit has been identified at time of analysis. The issue is rated CVSS 2.0 in the supplied CVSS 4.0 data and assessed as low severity with availability-only impact.
Local information disclosure in Intel MigTD, the Intel TDX Migration Trust Domain component operating in the Ring 0/hypervisor context, may expose sensitive residual data when a resource is released for reuse without being cleared. The issue affects deployments using Intel TDX with MigTD for live migration of trust domains; exploitation requires a privileged system-software adversary with local access and high attack complexity, with no user interaction required. Intel assigns a CVSS 4.0 base score of 6.8 with high confidentiality impact, and no public exploit was identified at time of analysis, with no CISA KEV confirmation in the supplied data.
Denial of service in the Intel TDX Migration Trust Domain (MigTD) stems from improper neutralization of data handled over the SPDM transport used during Trust Domain migration, allowing a network-adjacent, unauthenticated attacker to disrupt the migration path and degrade availability (vendor score CVSS 6.0 under CVSS:4.0; independently re-scored as AV:A/AC:H/PR:N with integrity-low and availability-high impact). Exposure is limited to Intel TDX platforms that actually have MigTD deployed and an active or reachable SPDM migration transport on the attacker's adjacent segment, and the impact does not propagate to subsequent systems (SC:N/SI:N/SA:N). No public exploit code or PoC reference was identified at time of analysis and there is no CISA KEV entry; the specific attack requirement indicated by AT:P is not described in the available sources, and Intel advisory SA-01580 is the reference point for fixed builds.
Denial of service in Intel TDX MigTD can be triggered by an authenticated local user through the migration vsock interface, where an integer overflow in Ring 0 can disrupt the hypervisor. Affected deployments are those using Intel TDX Migration Trust Domain (MigTD), particularly environments performing TDX trust-domain live migration; the supplied CPE does not specify affected version ranges. Exploitation requires local access, a low-privileged authenticated account, and high-complexity conditions, is limited to availability impact with low integrity impact, and no public exploit has been identified at time of analysis, making this a moderate this-month priority rather than an emergency.
Denial of service in Intel TDX Migration Trust Domain (MigTD) can be triggered through improperly validated quantity fields in MigTD vsock packet handling, allowing a privileged local system-software adversary at the hypervisor/VMM layer to disrupt availability. The issue affects Intel TDX deployments that actually run a Migration Trust Domain; confidentiality and integrity impacts are none, and the assessed severity is medium (CVSS 4.0 base 6.7, availability-only CVSS 3.1 assessment). The supplied data contains no CISA KEV entry or public exploit reference, so no public exploit identified at time of analysis; priority is this_month.
Information disclosure in Intel TDX Migration Trust Domain (MigTD) arises from use of uninitialized memory in the MigTD component, allowing a high-privileged attacker with adjacent network access to expose limited data. The impact is confined to low confidentiality loss, with no integrity or availability effect, and requires an Intel TDX deployment that uses MigTD for Trust Domain migration. No public exploit code or exploit reference is present in the provided intelligence, so no public exploit is identified at time of analysis; the vendor advisory is Intel-SA-01580.
Denial of service in Intel's TDX Migration Trust Domain (MigTD) stems from a memory leak (CWE-401) in its virtio-serial driver, which runs at Ring 0 in the hypervisor. Only deployments that actively use the MigTD virtio-serial path for TDX confidential-VM live migration are exposed, and the attacker must already hold local, privileged hypervisor/system-software access (CVSS:4.0 AV:L/PR:H), so practical impact is limited to low availability degradation with no confidentiality or integrity effect. No public exploit or CISA KEV entry was identified at time of analysis; Intel published advisory intel-sa-01580.
Improper validation of an array index (CWE-129) in the virtio-serial driver of Intel's TDX Migration Trust Domain (MigTD) allows a local, highly privileged adversary to crash or otherwise deny service on the migration component running in Ring 0. Only deployments that actually run Intel TDX with the MigTD migration feature are exposed, and the threat model is a malicious or compromised hypervisor that controls the virtio-serial device backend presented to MigTD; there is no confidentiality or integrity impact and no scope change, so consequences are limited to availability. The issue is rated medium (6.7 CVSS 4.0, assessed as CVSS 3.1 AV:L/AC:L/PR:H/UI:N/A:H), is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified, though the underlying class of bug is a plausible crash primitive for a hostile host, so it falls into the current-month remediation cadence rather than emergency response.
Integrity-only privilege escalation in the SPDM responder of Intel's TDX Migration Trust Domain (MigTD), caused by incomplete internal state distinction (CWE-372) that lets a privileged system-software adversary corrupt migration-related state rather than disclose data. Only deployments running Intel TDX confidential VMs with migration (MigTD) enabled are exposed, and exploitation requires an already privileged, adjacently positioned attacker (CVSS 4.0 6.8; AV:A/PR:H), so no confidentiality or availability impact results. No public exploit code or active exploitation is identified in the available sources, and the vendor advisory (Intel SA-01580) is the authoritative reference; EPSS and KEV data were not provided.
Integrity corruption and privilege escalation in Intel TDX MigTD are possible when a privileged local hypervisor adversary supplies crafted PCI BAR inputs that MigTD fails to validate. This medium-severity flaw (CVSS 4.0 base 6.7) is integrity-only, has no confidentiality or availability impact, and is relevant only where Intel TDX with the Migration Trust Domain is deployed; hosts not running TDX migration are unaffected. No public exploit was identified at time of analysis.
A denial-of-service condition exists in Intel's TDX Migration Trust Domain (MigTD), where the GetQuote routine contains a loop with an unreachable exit condition (CWE-835) and can therefore hang indefinitely. The flaw affects TDX-enabled platforms running MigTD in the Ring 0 hypervisor context; exploiting it requires local access with low complexity, no authentication and no user interaction (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N), so it is not remotely reachable. Impact is availability-only - the MigTD GetQuote/attestation path can be stalled - with no confidentiality, integrity or scope consequences; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though Intel has published advisory intel-sa-01580.
A time-of-check-to-time-of-use race in the Intel TDX Migration Trust Domain (MigTD) shared-memory interface lets privileged system software on the host - a hypervisor or Ring-0 operator - corrupt data after MigTD validates it but before it is used, producing a denial of service and integrity loss within the migration trust domain. The flaw is local-only and has no remote path, requires the attacker to already hold high privileges (PR:H) and to win a narrow race window (AT:P), and is relevant only where MigTD is actually deployed to mediate TDX live migration against an untrusted hypervisor; confidentiality is not affected. Intel rates the issue at CVSS 4.0 base 5.7, an independent assessment lands at CVSS 3.1 AV:L/AC:H/PR:H/UI:N/S:U with high integrity and availability impact, and the current priority is to schedule remediation this month; no public exploit code or in-the-wild activity was identified at time of analysis.
Privilege escalation and information disclosure in Intel TDX MigTD stem from an expired-pointer dereference in the virtio-vsock implementation, reachable by a malicious or compromised hypervisor holding Ring 0 control. The issue is local (AV:L) and requires high privileges (PR:H) but is low complexity with no attack requirements or user interaction, and successful exploitation can result in high impact to confidentiality, integrity, and availability of the TDX system while leaving subsequent systems unaffected; no public exploit was identified at time of analysis.
Missing authentication in the Intel TDX Migration Trust Domain (MigTD) SPDM rebind path allows an unauthenticated attacker on an adjacent network to escalate privileges, disclose information and potentially achieve remote code execution on hosts engaged in Trust Domain migration. The flaw is scored 9.4 under CVSS 4.0 and carries a scope-change vector (AV:A/AC:L/PR:N/UI:N/S:C) with high confidentiality, integrity and availability impact to the vulnerable component and to subsequent systems. No public exploit code or CISA KEV entry is associated with it at time of analysis, and the priority label is act_now; the practical limit on exposure is reachability, since the attacker must sit on a logically adjacent path to a host that is actively using MigTD migration.
Capture-replay authentication bypass in Intel TDX Migration Trust Domain (MigTD) lets a local, highly privileged system-software adversary replay a legitimate migration-authentication exchange to escalate privilege in Ring 0 and compromise confidentiality and integrity; availability impact is none. Only environments running Intel TDX confidential-computing live migration with MigTD active are exposed, and the attacker needs a high-privilege hypervisor position plus local access, substantially narrowing the realistic attacker set. No CISA KEV entry or public exploit code is identified in the available data, though the issue is labeled act_now in priority intelligence.
Write-what-where in the Intel TDX Migration Trust Domain (MigTD) lets a privileged local adversary who already holds Ring 0/hypervisor-level control convert that position into high confidentiality, integrity and availability impact on TDX-enabled hosts, with potential information disclosure and escalation of privilege. Only platforms that deploy Intel TDX with MigTD-based migration are in scope, and the attacker must already sit at the system-software/hypervisor layer, so guest workloads and remote network attackers cannot reach the flaw on their own. No public exploit identified at time of analysis, and the vuln.today priority label 'this_week' reflects a genuine but access-gated issue rather than a mass-exploitation threat.
Privilege escalation in Intel TDX's Migration Trust Domain (MigTD) allows an adversary who already controls the Ring 0 hypervisor/VMM to cross the isolation boundary that TDX is built to enforce, through an out-of-range pointer offset in MigTD's virtio-vsock implementation. Only hosts running Intel TDX with the MigTD migration trust domain are affected, and the vector is local with low attack complexity and no user interaction but requires high privilege (control of the hypervisor), so the high confidentiality, integrity and availability impact is reachable only from an already-dominant position. No public exploit code or active exploitation was identified in the available data, and the priority assessment places remediation in the current week.
Insufficient access-control granularity in the MigTD v2 policy evaluation engine within Intel TDX's Migration Trust Domain allows a network adversary positioned on an adjacent network to achieve privilege escalation inside the Ring 0 (hypervisor) layer, with high confidentiality and integrity impact extending to subsequent systems. Exploitation requires the target to be running Intel TDX with MigTD v2 and its policy evaluation engine active, and while no authentication or user interaction is needed, the attack is rated high complexity and the specific trigger mechanism is not described in the available sources. No public exploit code or PoC reference was identified at time of analysis and the vulnerability is not in CISA KEV; the vendor advisory is Intel SA-01580.
Information disclosure in Intel's TDX Migration Trust Domain (MigTD) lets a network-reachable adversary read data that should stay inside the confidential-computing boundary: the SPDM responder does not properly clean up when an exception is thrown, and per the assessed vector the attacker needs no authentication, no special attack requirements and no user interaction (CVSS 4.0 base 8.7, confidentiality high, integrity and availability none). Real-world exposure is confined to hosts where Intel TDX with MigTD is deployed and the SPDM responder is reachable during a Trust Domain migration or attestation session, rather than general-purpose systems. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor (Intel) is the reporting source and the issue is prioritized as a this-week item rather than an emergency.
Privilege escalation in the Intel TDX Migration Trust Domain (MigTD) signing path allows a privileged local system-software adversary at the Ring-0/hypervisor level to abuse confused-deputy behavior and expand integrity and confidentiality impact across the TDX trust boundary. The flaw affects hosts running Intel TDX confidential computing with MigTD-based migration enabled; it is local-only, requires high existing privileges, and no public exploit code or KEV-listed active exploitation was identified at time of analysis. CVSS 8.2 reflects high integrity impact and scope change, not remote reachability.
Authentication bypass in the Intel TDX Migration Trust Domain (MigTD) rebinding protocol allows a privileged local adversary, such as a malicious or compromised Ring 0 hypervisor, to spoof rebinding traffic and escalate privileges, potentially enabling local code execution with high confidentiality, integrity, and availability impact on the vulnerable system and subsequent systems. Exposure is limited to platforms that use TDX live migration and the MigTD rebinding path; platforms not using TDX migration are not exposed. The vulnerability is local and requires high privileges (PR:H) rather than remote or unauthenticated access, and no public exploit has been identified at time of analysis, but the act-now priority reflects the low attack complexity once the privileged-local and MigTD preconditions are met.
Improper initialization in the virtio-vsock stream handling of the Intel TDX Migration Trust Domain (MigTD) lets a local system-software adversary - the untrusted hypervisor/VMM - drive the migration TD into a denial-of-service and low-integrity data-corruption condition. Exposure is narrowly scoped: the host must be an Intel TDX-capable platform that is actually running MigTD with TD migration enabled, and the attacker must already hold the local hypervisor position, so there is no remote attack path. CVSS 4.0 scores the issue 5.1 (AV:L/AC:L/AT:N/PR:N/UI:N, with low integrity and availability impact and no confidentiality or scope impact); no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), placing it in a this-month remediation cadence rather than an emergency one.
Adjacent-network attackers can degrade availability of Intel TDX Migration Trust Domain (MigTD), the component that handles live migration of Trust Domains in Intel TDX confidential computing, through incorrect ordering of operations in the get_tcb_level_by_svn routine. The flaw is reachable without authentication (PR:N) and without user interaction (UI:N) from the migration fabric, but impact is limited to availability (A:L) with no confidentiality or integrity effect and no code execution. Exposure is confined to environments where Intel TDX with Trust Domain migration is actually deployed, and no public exploit has been identified at time of analysis; priority is assessed as this-month rather than emergency.
Intel TDX Migration Trust Domain (MigTD) contains an unchecked return value in its TLS implementation, classified CWE-252, that a network adversary can leverage for a denial of service against the migration agent. Affected deployments are those using TDX live migration with MigTD, where an unauthenticated attacker on an adjacent network segment can trigger the fault with low attack complexity and no user interaction; impact is confined to low integrity and low availability of MigTD itself, with no confidentiality or subsequent-system effects. No public exploit code or CISA KEV entry was identified in the available sources, and the vuln.today priority is 'this_month' rather than emergency, reflecting the adjacent-access precondition; the vendor advisory is Intel-SA-01580.
Local denial of service in Intel TDX's Migration Trust Domain (MigTD) affects platforms where TDX and MigTD-based live migration are enabled. A privileged system-software adversary who controls the hypervisor or ring-0 host can drive MigTD into an error path whose return value is not checked (CWE-252), causing availability impact with no confidentiality or integrity effect. The issue requires local access and high privileges, is rated medium severity (CVSS 4.0 base 6.7), and no CISA KEV listing or public exploit was identified at time of analysis.
Integrity-only privilege escalation in Intel TDX MigTD can let a privileged local adversary at Ring 0 abuse the vmcall_raw transport to corrupt the migration trust domain’s integrity, with no confidentiality or availability impact and no subsequent-system effect. The issue affects environments that actually deploy the Intel TDX Migration Trust Domain (MigTD) and requires a specific attack prerequisite (AT:P) in addition to high privilege and local access; the exact trigger is not described in the available sources. No public exploit was identified at time of analysis, and the medium-severity CVSS 4.0 score of 5.6 aligns with a this-month priority rather than emergency response.
CVE-2026-61470 is a lifetime-management flaw, classified as CWE-664 improper control of a resource through its lifetime, in the TLS client component of Intel's TDX Migration Trust Domain (MigTD), which runs at Ring 0 hypervisor level. An attacker who already holds an adjacent network position, with no authentication and no user interaction required, can exploit the low-complexity flaw to cause a denial of service and limited data corruption within the MigTD itself, with integrity and availability impact rated low and no confidentiality loss; only environments actually deploying Intel TDX migration with the MigTD TLS client active are exposed. It is scored 5.3 under CVSS 4.0 (and 5.3 in the independent CVSS 3.1 assessment) and vuln.today assigns it a 'this_month' priority, indicating routine rather than emergency patching; no public exploit code or confirmed active exploitation is identified in the available data.
An off-by-one error in Intel TDX MigTD's vmcall_raw transport can let a local Ring-0/hypervisor-level system-software adversary corrupt data or cause denial of service on TDX-enabled platforms running the migration trust domain. The CVSS 4.0 vector indicates local access, low attack complexity, no attack requirements, no authentication enforced by the transport, and no user interaction, with low integrity and availability impact and no confidentiality impact or subsequent-system impact. No public exploit was identified at time of analysis, and the issue is assessed as moderate rather than urgent risk.
Information disclosure in the logging path of the Intel TDX Migration Trust Domain (MigTD) lets an adversary who already controls Ring 0 system software - a compromised or malicious hypervisor with local access to the host - read confidential trust-domain data the logging code fails to protect. The root cause is improper privilege management (CWE-269) in MigTD logging rather than a memory-safety defect, and impact is confined to confidentiality with high severity for that one property; integrity and availability are unaffected and there is no scope change. Our re-assessment lands at medium severity (CVSS 3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) with low urgency, escalated only by the high privilege already required to reach the flaw. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; Intel has published advisory intel-sa-01580, and the vuln.today decision label is 'this_month'.
Use-after-free in the MigTD virtio driver, a Ring 0 component of the Intel TDX Migration Trust Domain used during trust-domain migration, allows a high-privileged local attacker to corrupt kernel memory and escalate privileges, with high integrity and low availability impact and no confidentiality impact. Only hosts running Intel TDX with the MigTD migration component are affected, and exploitation requires an already-privileged 'system software adversary' - effectively a malicious or compromised hypervisor/Ring 0 component - with local access and low attack complexity. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; it is assessed as a this-month patch item rather than an emergency.
Incorrect buffer-size calculation in Intel TDX Migration Trust Domain (MigTD)'s servtd_get_quote quote-retrieval path can allow a local adversary with hypervisor/Ring-0 system-software privileges to trigger a low-impact denial of service. Exploitation is constrained by high attack complexity and a required attack precondition, and no public exploit has been identified at time of analysis. The issue is rated CVSS 2.0 in the supplied CVSS 4.0 data and assessed as low severity with availability-only impact.
Local information disclosure in Intel MigTD, the Intel TDX Migration Trust Domain component operating in the Ring 0/hypervisor context, may expose sensitive residual data when a resource is released for reuse without being cleared. The issue affects deployments using Intel TDX with MigTD for live migration of trust domains; exploitation requires a privileged system-software adversary with local access and high attack complexity, with no user interaction required. Intel assigns a CVSS 4.0 base score of 6.8 with high confidentiality impact, and no public exploit was identified at time of analysis, with no CISA KEV confirmation in the supplied data.
Denial of service in the Intel TDX Migration Trust Domain (MigTD) stems from improper neutralization of data handled over the SPDM transport used during Trust Domain migration, allowing a network-adjacent, unauthenticated attacker to disrupt the migration path and degrade availability (vendor score CVSS 6.0 under CVSS:4.0; independently re-scored as AV:A/AC:H/PR:N with integrity-low and availability-high impact). Exposure is limited to Intel TDX platforms that actually have MigTD deployed and an active or reachable SPDM migration transport on the attacker's adjacent segment, and the impact does not propagate to subsequent systems (SC:N/SI:N/SA:N). No public exploit code or PoC reference was identified at time of analysis and there is no CISA KEV entry; the specific attack requirement indicated by AT:P is not described in the available sources, and Intel advisory SA-01580 is the reference point for fixed builds.
Denial of service in Intel TDX MigTD can be triggered by an authenticated local user through the migration vsock interface, where an integer overflow in Ring 0 can disrupt the hypervisor. Affected deployments are those using Intel TDX Migration Trust Domain (MigTD), particularly environments performing TDX trust-domain live migration; the supplied CPE does not specify affected version ranges. Exploitation requires local access, a low-privileged authenticated account, and high-complexity conditions, is limited to availability impact with low integrity impact, and no public exploit has been identified at time of analysis, making this a moderate this-month priority rather than an emergency.
Denial of service in Intel TDX Migration Trust Domain (MigTD) can be triggered through improperly validated quantity fields in MigTD vsock packet handling, allowing a privileged local system-software adversary at the hypervisor/VMM layer to disrupt availability. The issue affects Intel TDX deployments that actually run a Migration Trust Domain; confidentiality and integrity impacts are none, and the assessed severity is medium (CVSS 4.0 base 6.7, availability-only CVSS 3.1 assessment). The supplied data contains no CISA KEV entry or public exploit reference, so no public exploit identified at time of analysis; priority is this_month.
Information disclosure in Intel TDX Migration Trust Domain (MigTD) arises from use of uninitialized memory in the MigTD component, allowing a high-privileged attacker with adjacent network access to expose limited data. The impact is confined to low confidentiality loss, with no integrity or availability effect, and requires an Intel TDX deployment that uses MigTD for Trust Domain migration. No public exploit code or exploit reference is present in the provided intelligence, so no public exploit is identified at time of analysis; the vendor advisory is Intel-SA-01580.
Denial of service in Intel's TDX Migration Trust Domain (MigTD) stems from a memory leak (CWE-401) in its virtio-serial driver, which runs at Ring 0 in the hypervisor. Only deployments that actively use the MigTD virtio-serial path for TDX confidential-VM live migration are exposed, and the attacker must already hold local, privileged hypervisor/system-software access (CVSS:4.0 AV:L/PR:H), so practical impact is limited to low availability degradation with no confidentiality or integrity effect. No public exploit or CISA KEV entry was identified at time of analysis; Intel published advisory intel-sa-01580.
Improper validation of an array index (CWE-129) in the virtio-serial driver of Intel's TDX Migration Trust Domain (MigTD) allows a local, highly privileged adversary to crash or otherwise deny service on the migration component running in Ring 0. Only deployments that actually run Intel TDX with the MigTD migration feature are exposed, and the threat model is a malicious or compromised hypervisor that controls the virtio-serial device backend presented to MigTD; there is no confidentiality or integrity impact and no scope change, so consequences are limited to availability. The issue is rated medium (6.7 CVSS 4.0, assessed as CVSS 3.1 AV:L/AC:L/PR:H/UI:N/A:H), is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified, though the underlying class of bug is a plausible crash primitive for a hostile host, so it falls into the current-month remediation cadence rather than emergency response.
Integrity-only privilege escalation in the SPDM responder of Intel's TDX Migration Trust Domain (MigTD), caused by incomplete internal state distinction (CWE-372) that lets a privileged system-software adversary corrupt migration-related state rather than disclose data. Only deployments running Intel TDX confidential VMs with migration (MigTD) enabled are exposed, and exploitation requires an already privileged, adjacently positioned attacker (CVSS 4.0 6.8; AV:A/PR:H), so no confidentiality or availability impact results. No public exploit code or active exploitation is identified in the available sources, and the vendor advisory (Intel SA-01580) is the authoritative reference; EPSS and KEV data were not provided.
Integrity corruption and privilege escalation in Intel TDX MigTD are possible when a privileged local hypervisor adversary supplies crafted PCI BAR inputs that MigTD fails to validate. This medium-severity flaw (CVSS 4.0 base 6.7) is integrity-only, has no confidentiality or availability impact, and is relevant only where Intel TDX with the Migration Trust Domain is deployed; hosts not running TDX migration are unaffected. No public exploit was identified at time of analysis.
A denial-of-service condition exists in Intel's TDX Migration Trust Domain (MigTD), where the GetQuote routine contains a loop with an unreachable exit condition (CWE-835) and can therefore hang indefinitely. The flaw affects TDX-enabled platforms running MigTD in the Ring 0 hypervisor context; exploiting it requires local access with low complexity, no authentication and no user interaction (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N), so it is not remotely reachable. Impact is availability-only - the MigTD GetQuote/attestation path can be stalled - with no confidentiality, integrity or scope consequences; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though Intel has published advisory intel-sa-01580.
A time-of-check-to-time-of-use race in the Intel TDX Migration Trust Domain (MigTD) shared-memory interface lets privileged system software on the host - a hypervisor or Ring-0 operator - corrupt data after MigTD validates it but before it is used, producing a denial of service and integrity loss within the migration trust domain. The flaw is local-only and has no remote path, requires the attacker to already hold high privileges (PR:H) and to win a narrow race window (AT:P), and is relevant only where MigTD is actually deployed to mediate TDX live migration against an untrusted hypervisor; confidentiality is not affected. Intel rates the issue at CVSS 4.0 base 5.7, an independent assessment lands at CVSS 3.1 AV:L/AC:H/PR:H/UI:N/S:U with high integrity and availability impact, and the current priority is to schedule remediation this month; no public exploit code or in-the-wild activity was identified at time of analysis.