CVE-2026-62920

MediumCVSS 6.7/10Last modified Nov 12, 2026

Description

Unchecked return value in the MigTD error handling for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 4.0 6.7/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-252

Affected software

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-629256.5Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency CVE-2026-629277.5In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculati CVE-2026-629289.3XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.CVE-2026-629298.4Expired pointer dereference in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hy CVE-2026-62934.3The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting i CVE-2026-629305.3Unchecked return value in the MigTD's TLS implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may a CVE-2026-62944.3The Google PageRank Display plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.4. This is du CVE-2026-629409.9Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-CVE-2026-629419.9Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restr CVE-2026-629438.7btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's ssh_filter_btrbk.sh constru CVE-2026-629454.3TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id CVE-2026-629464.7ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2