---
id: "CVE-2026-60138"
page: "https://infrastack.ai/live/CVE-2026-60138"
kind: "vulnerability"
aliases: ["CVE-2026-60138"]
title: "Intel TDX MigTD: out-of-range pointer offset lets privileged software escalate"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "MigTD", "fixed": ["0.7.2"], "affected": "< 0.7.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["confidential-computing", "infrastructure", "intel-tdx", "migtd", "virtio-vsock"]
not_affected_if: ["no-tdx-migration"]
published_at: "2026-11-10T18:17:43+00:00"
first_seen_at: "2026-11-10T18:22:59+00:00"
updated_at: "2026-11-10T18:25:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60138", "first_seen_at": "2026-11-10T18:22:59+00:00"}, {"source": "analyst", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html", "first_seen_at": "2026-11-10T18:25:54+00:00", "cites": ["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"]}]
exploit_sources: []
---

# Intel TDX MigTD: out-of-range pointer offset lets privileged software escalate

Link for people: https://infrastack.ai/live/CVE-2026-60138 (this .md is for agents)

The MigTD component of Intel's TDX Migration Trust Domain has an out-of-range pointer offset in its virtio-vsock code. A privileged system software adversary on the host can escalate privileges and affect confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MigTD affected < 0.7.2 fixed 0.7.2

## How to check

Check the MigTD reference software version you build or deploy (the intel/MigTD release); any version before 0.7.2 is affected. Also check whether your TDX platform uses live migration with MigTD.

## Fix

Update MigTD to 0.7.2 or later (Intel INTEL-SA-01580)

## Timeline

- 2026-11-10T18:22:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-60138
- 2026-11-10T18:25:54+00:00 analyst https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html — Intel INTEL-SA-01580 (rev 1.0, 2026-11-10) lists CVE-2026-60138: MigTD < 0.7.2 affected, fixed in 0.7.2. No exploitation or PoC found. web-cli unavailable in this environment; only the advisory was read via WebFetch (NVD page returned nothing useful); X/discussion not searched.

## Documents

- [advisory] INTEL-SA-01580 Intel TDX Migration Trust Domain (MigTD) Advisory https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html

## From the sources

Use of out-of-range pointer offset in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_