CVE-2026-40693

MediumCVSS 5.7/10Last modified Nov 12, 2026

Description

Improper input validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 4.0 5.7/10

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-20

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
n/a	Intel(R) TDX Workload Attestation software	See references

References

https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01520.html

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-406945.8Out-of-bounds write for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a denial of service. Unprivileged CVE-2026-406956.8Null pointer dereference for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Unprivileged software CVE-2026-406975.8Use after free for some Intel(R) Wireless Software for Windows within Ring 3: User Applications may allow denial of service. Unprivileged so CVE-2026-406988.7A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrat CVE-2026-406996.5A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to acces CVE-2026-40704.3The Alfie – Feed Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This i CVE-2026-407014.8NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" CVE-2026-407029.4WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can e CVE-2026-407035.4A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. Note: Software versions whic CVE-2026-407045.4Protection mechanism failure for some Intel Neural Compressor software before version master within Ring 3: User Applications may allow an e CVE-2026-407056.8Improper resource locking for the Intel(R) NPU Drivers before version 32.0.100.4778 within Ring 1: Device Drivers may allow a denial of serv CVE-2026-407068.4In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to