CVE WatchNov 10, 2026

CVE-2026-60138

Use of out-of-range pointer offset in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Rin

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0-100

Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-823

EPSS · 30d

Not enough EPSS history yet.

Technical description

Use of out-of-range pointer offset in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Official references

intel.comhttps://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1055417.8 HIG

—

——0Use of out-of-range pointer offset in Windows Audio Service allows an authorized attacker to elevate privileges locally.3h CVE-2026-749158.8 HIG

18.9%

——6A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device.5d CVE-2026-749129.8 CRI

21.8%

——7On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is limited which causes errors when the mapping outside of that range. Integer truncation caused when mapping GPU buffer pages in the buffer’s range 0GB - 4GB, produces error and limits the functionality of the kernel mode driver.5d CVE-2026-93862—

5.7%

——2An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to repeatedly crash the firewall's cluster synchronization process by sending specially crafted network traffic, resulting in a sustained denial of service.13d CVE-2026-1075702.5 LOW

4.3%

——1heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.32d CVE-2026-104944—

22.6%

——7TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition. Successful exploitation may allow an unauthenticated attacker with network access to the affected UDP service to repeatedly crash the TDP daemon, disrupting normal device operation and availability. No authentication, session establishment, or pairing is required to trigger the condition.34d