{"id":"CVE-2026-62275","kind":"vulnerability","aliases":["CVE-2026-62275"],"related":[],"title":"Intel TDX MigTD: missing error handling in vmcall_raw enables data corruption","description":"Detection of error condition without action in the MigTD's vmcall_raw transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"The Intel TDX Migration Trust Domain (MigTD) does not act on an error condition detected in its vmcall_raw transport. A privileged local attacker on the system software side can corrupt data, and the description also mentions a possible hypervisor privilege escalation.","severity":"medium","cvss":5.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["confidential-computing","hypervisor","infrastructure","intel-tdx","migtd"],"not_affected_if":["no-tdx-migration"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T18:17:44+00:00","first_seen_at":"2026-11-10T18:23:00+00:00","triaged_at":"2026-11-10T18:25:09+00:00","updated_at":"2026-11-10T18:25:09+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T18:25:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel TDX MigTD: missing error handling in vmcall_raw enables data corruption","impact":"medium","summary":"The Intel TDX Migration Trust Domain (MigTD) does not act on an error condition detected in its vmcall_raw transport. A privileged local attacker on the system software side can corrupt data, and the description also mentions a possible hypervisor privilege escalation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel-tdx","migtd","confidential-computing","hypervisor"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"privileged local attacker corrupts data inside the trust domain","analyst_note":"Check Intel's security advisory for affected MigTD versions and the fixed release, since the NVD entry gives neither.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-tdx-migration"],"who_is_affected":"Affects Intel TDX deployments that use the MigTD live-migration component within Ring 0. The sources do not name specific MigTD versions or configurations. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":4674,"output_tokens":453,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-62275':15A,18A '0':94C 'access':126C 'act':37B 'action':75C 'adversari':104C 'allow':97C 'also':63B 'attack':51B,114C,128C 'avail':152C,167C 'combin':109C 'complex':113C 'comput':21B 'condit':41B,73C 'confidenti':20B,147C,162C 'confidential-comput':19B 'corrupt':12A,58B,118C 'cve':13A,16A 'data':11A,59B,117C 'descript':62B 'detect':42B,70C 'domain':33B,90C 'enabl':10A,116C 'error':5A,40B,72C 'escal':69B,99C 'handl':6A 'high':150C 'hypervisor':22B,67B,95C 'impact':145C,169C 'infrastructur':23B 'integr':149C,164C 'intel':1A,25B,29B,85C 'intel-tdx':24B 'interact':140C 'intern':134C 'knowledg':135C 'local':50B,125C 'low':112C 'may':96C,115C,121C,144C 'mention':64B 'migrat':31B,88C 'migtd':3A,27B,34B,78C,91C 'miss':4A 'none':148C,153C,163C,165C,168C 'occur':123C 'possibl':66B 'potenti':122C,142C 'present':131C 'privileg':49B,68B,101C,107C 'r':86C 'raw':9A,46B,81C 'requir':129C,137C 'result':120C,158C 'ring':93C 'side':56B 'softwar':55B,103C 'special':133C 'subsequ':160C 'system':54B,102C,157C,161C 'tdx':2A,26B,30B,87C 'transport':47B,82C 'trust':32B,89C 'user':108C,139C 'via':124C 'vmcall':8A,45B,80C 'vulner':143C,156C 'within':92C 'without':74C,132C","nicknames":[],"mitigations":[],"who_affected":"Affects Intel TDX deployments that use the MigTD live-migration component within Ring 0. The sources do not name specific MigTD versions or configurations. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["confidentialcomputing","hypervisor","infrastructure","inteltdx","medium","migtd"],"campaign_type":null,"search_a":"'-2026':14A,17A '-62275':15A,18A 'corrupt':12A 'cve':13A,16A 'data':11A 'enabl':10A 'error':5A 'handl':6A 'intel':1A 'migtd':3A 'miss':4A 'raw':9A 'tdx':2A 'vmcall':8A","search_b":"'act':37B 'also':63B 'attack':51B 'comput':21B 'condit':41B 'confidenti':20B 'confidential-comput':19B 'corrupt':58B 'data':59B 'descript':62B 'detect':42B 'domain':33B 'error':40B 'escal':69B 'hypervisor':22B,67B 'infrastructur':23B 'intel':25B,29B 'intel-tdx':24B 'local':50B 'mention':64B 'migrat':31B 'migtd':27B,34B 'possibl':66B 'privileg':49B,68B 'raw':46B 'side':56B 'softwar':55B 'system':54B 'tdx':26B,30B 'transport':47B 'trust':32B 'vmcall':45B","search_c":"'0':94C 'access':126C 'action':75C 'adversari':104C 'allow':97C 'attack':114C,128C 'avail':152C,167C 'combin':109C 'complex':113C 'condit':73C 'confidenti':147C,162C 'corrupt':118C 'data':117C 'detect':70C 'domain':90C 'enabl':116C 'error':72C 'escal':99C 'high':150C 'hypervisor':95C 'impact':145C,169C 'integr':149C,164C 'intel':85C 'interact':140C 'intern':134C 'knowledg':135C 'local':125C 'low':112C 'may':96C,115C,121C,144C 'migrat':88C 'migtd':78C,91C 'none':148C,153C,163C,165C,168C 'occur':123C 'potenti':122C,142C 'present':131C 'privileg':101C,107C 'r':86C 'raw':81C 'requir':129C,137C 'result':120C,158C 'ring':93C 'softwar':103C 'special':133C 'subsequ':160C 'system':102C,157C,161C 'tdx':87C 'transport':82C 'trust':89C 'user':108C,139C 'via':124C 'vmcall':80C 'vulner':143C,156C 'within':92C 'without':74C,132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62275","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62275","severity":null,"published_at":"2026-11-10T18:17:44+00:00","modified_at":"2026-11-10T18:17:44+00:00","first_seen_at":"2026-11-10T18:23:00+00:00","fetched_at":"2026-11-10T18:23:00+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}