---
id: "CVE-2026-57890"
page: "https://infrastack.ai/live/CVE-2026-57890"
kind: "vulnerability"
aliases: ["CVE-2026-57890"]
title: "Intel TDX MigTD: improper cleanup after exception can leak data over network"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "MigTD", "fixed": ["0.7.2"], "affected": "< 0.7.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["confidential-computing", "hypervisor", "infrastructure", "intel-tdx", "migtd"]
not_affected_if: ["no-tdx-migration"]
published_at: "2026-11-10T18:17:41+00:00"
first_seen_at: "2026-11-10T18:22:59+00:00"
updated_at: "2026-11-10T18:26:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57890", "first_seen_at": "2026-11-10T18:22:59+00:00"}, {"source": "analyst", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html", "first_seen_at": "2026-11-10T18:26:58+00:00", "cites": ["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html", "https://github.com/intel/MigTD/releases/tag/v0.7.2"]}]
exploit_sources: []
---

# Intel TDX MigTD: improper cleanup after exception can leak data over network

Link for people: https://infrastack.ai/live/CVE-2026-57890 (this .md is for agents)

Intel's MigTD component, which handles migration of confidential VMs under TDX, does not clean up properly when an exception is thrown in its SPDM responder. A network attacker without credentials can read data exposed by this, with confidentiality impact only.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MigTD affected < 0.7.2 fixed 0.7.2

## How to check

Check the version of the MigTD binary/build you deploy for TDX live migration (built from github.com/intel/MigTD, or supplied by your platform/cloud vendor): any version before 0.7.2 is affected. If you do not use TDX live migration (no MigTD), you can skip this.

## Fix

Update Intel TDX Migration Trust Domain (MigTD) reference software to version 0.7.2 or later (https://github.com/intel/MigTD/releases/tag/v0.7.2). Intel lists no workarounds.

## Timeline

- 2026-11-10T18:22:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57890
- 2026-11-10T18:26:58+00:00 analyst https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html — Intel INTEL-SA-01580 (11/10/2026, covers many MigTD CVEs): all MigTD reference software before 0.7.2 affected, fixed in 0.7.2 (GitHub release). No workarounds, no exploitation statement. Intel scores this CVE CVSS 4.0 8.7 (AV:N, PR:N, VC:H); advisory overall rating Medium. Release page not read, fix taken from advisory text.

## Documents

- [advisory] INTEL-SA-01580 Intel TDX Migration Trust Domain (MigTD) Advisory https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html
- [fix] intel/MigTD v0.7.2 https://github.com/intel/MigTD/releases/tag/v0.7.2

## From the sources

Improper cleanup on thrown exception in the MigTD's SPDM responder for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an information disclosure. Network adversary with an unauthenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_