Intel TDX MigTD: Expired pointer dereference in virtio-vsock implementation
Summary
The virtio-vsock implementation of the Migration Trust Domain (MigTD) for Intel TDX contains an expired pointer dereference (CWE-825). A local attacker with privileged access in system software or on the hypervisor side may be able to escalate privileges and disclose information, according to the CVE record. The CVSS v4.0 vector given in the record requires high privileges and no user interaction, so this is not a remotely exploitable internet-facing flaw.
Affected
- Intel TDX Migration Trust Domain (MigTD) (affected versions unknown; the record states 'affected', while the official CNA record lists the product as affected with details in the Intel advisory)
- Exact affected version ranges: Unknown.
Fixed in
Unknown. Check the Intel advisory INTEL-SA-01580 for fixed MigTD versions and any required TDX module or firmware updates.
Workaround
Unknown.
Exploitation
- No public exploitation or proof of concept known at the time of research.
- Not listed in CISA KEV at the time of research.
- These are absence-of-evidence findings and should be re-checked.
Our recommendation
- Open Intel advisory INTEL-SA-01580 and record affected and fixed versions.
- Ask your cloud or hosting provider whether they run Intel TDX with live migration and whether the Intel fix has been applied.
- If you operate TDX hosts, apply the Intel reference software or firmware updates once confirmed.
- Re-check NVD, CISA KEV and the Intel advisory for updated scoring and exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01580 intel.com
- Intel MigTD GitHub repository github.com
- MigTD releases github.com
- Intel TDX Live Migration presentation (LPC) lpc.events
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 19:27.
Original description (NVD)
Expired pointer dereference in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.