Intel TDX Migration Trust Domain (MigTD): Denial of service in TLS implementation
Summary
The Intel TDX Migration Trust Domain (MigTD) component, which runs in Ring 0, has an unchecked return value in its TLS implementation (CWE-252). An attacker with network or adjacent access and no privileges or user interaction may be able to cause a denial of service, with low impact on integrity and availability. The CVE description says "network adversary", but the CVSS vector specifies adjacent access (AV:A), so the vector should be used for assessment until Intel clarifies.
Affected
Unknown. The CVE record only lists "See references". Version ranges are not documented in the sources reviewed; see Intel advisory INTEL-SA-01580.
Fixed in
Unknown. Intel states that reference software updates are being released in advisory INTEL-SA-01580. Check the advisory for the fixed versions.
Workaround
Unknown. No vendor-stated workaround is documented.
Exploitation
- No reports of exploitation in the wild found.
- Not listed in CISA KEV.
- EPSS score below 1%.
- No public proof-of-concept found; this result is indicative only, based on a sibling CVE.
Our recommendation
- If you operate Intel TDX hosts with confidential VMs and migration, ask your hardware or cloud provider when the MigTD update from INTEL-SA-01580 will be available, and apply it in the normal patch cycle.
- Most SMEs are not affected, so no action is needed if you do not use TDX.
- Monitor the Intel advisory for affected and fixed version information.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Advisory INTEL-SA-01580 intel.com
- OpenCVE: CVE-2026-62930 app.opencve.io
- Strix: CVE-2026-62930 www.strix.ai
- OffSeq Radar: CVE-2026-62930 radar.offseq.com
- Intel Product Security Center www.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:37.
Original description (NVD)
Unchecked return value in the MigTD's TLS implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.