ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord
CVE-2026-42067

Intel(R) TDX Workload Attestation software · Vulnerability

CVSS 4.0 5.9 MEDIUMEUVD CVSS 4.0 5.9 CVSS 4.0 · [email protected] · Secondary 5.9 MEDIUMCVSS_V4 Fixed by tdx_workload_attestation 0.2.0KEV status unknown
Original advisory

cve-program · CVE-2026-42067

Published

Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Read the publisher's advisory

euvd · EUVD-2026-121316

Published

Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Read the publisher's advisory

nvd · CVE-2026-42067

Published

Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Read the publisher's advisory

osv · RUSTSEC-2026-0481

Published

`tdx_workload_attestation::verification::x509::verify_x509_cert()`, available with the `host-verification` feature, checked that `issuer_cert` issued `cert` and verified the certificate signature. It did not check the certificate's validity period, so it accepted expired and not-yet-valid certificates. With the `host-gcp-tdx` feature, this function validates the GCP launch endorsement signing certificate against the GCE confidential-computing TCB root certificate. A signing certificate outside its validity period was therefore still accepted during launch endorsement verification. Intel describes the issue as improper certificate validation and classifies it as escalation of privilege, with a CVSS 4.0 base score of 5.9, in INTEL-SA-01520. The flaw was corrected in [#86](https://github.com/IntelLabs/tdx-workload-attestation/pull/86), released in 0.2.0. The function now returns `Ok(false)` when the current time is outside the certificate's `notBefore`/`notAfter` range. Reported by [Borys Tsyrulnikov](https://borystsyrulnikov.dev).

Read the publisher's advisory

Affected versions, risk and source history

Exploitation and risk

Source status

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

cve-program · CVE-2026-42067

Published

Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low comp…

Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Source published
10 Nov 2026 16:30:50 UTC
Source modified
11 Nov 2026 10:48:01 UTC
Saved here
11 Nov 2026 11:57:25 UTC
Source terms
CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · 5.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

euvd · EUVD-2026-121316

Published

Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low comp…

Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Additional publisher context

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Nov 10, 2026, 4:30:50 PM

dateUpdated: Nov 11, 2026, 10:48:01 AM

Source published
Nov 10, 2026, 4:30:50 PM (timezone not stated)
Source modified
Nov 11, 2026, 10:48:01 AM (timezone not stated)
Saved here
15 Nov 2026 10:05:17 UTC
Source terms
ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 4.0 · 5.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

nvd · CVE-2026-42067

Published

Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low comp…

Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Additional publisher context

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Awaiting Analysis

Weakness classifications: CWE-295

Original publisher date fields

published: 2026-11-10T17:17:43.447

lastModified: 2026-11-11T11:17:20.233

Source published
10 Nov 2026 17:17:43 UTC
Source modified
11 Nov 2026 11:17:20 UTC
Saved here
13 Nov 2026 09:56:59 UTC
Source terms
NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · [email protected] · Secondary · 5.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv · RUSTSEC-2026-0481

Published

`verify_x509_cert` does not check the certificate validity period

`tdx_workload_attestation::verification::x509::verify_x509_cert()`, available with the `host-verification` feature, checked that `issuer_cert` issued `cert` and verified the certificate signature. It did not check the certificate's validity period, so it accepted expired and not-yet-valid certificates. With the `host-gcp-tdx` feature, this function validates the GCP launch endorsement signing certificate against the GCE confidential-computing TCB root certificate. A signing certificate outside its validity period was therefore still accepted during launch endorsement verification. Intel describes the issue as improper certificate validation and classifies it as escalation of privilege, with a CVSS 4.0 base score of 5.9, in INTEL-SA-01520. The flaw was corrected in [#86](https://github.com/IntelLabs/tdx-workload-attestation/pull/86), released in 0.2.0. The function now returns `Ok(false)` when the current time is outside the certificate's `notBefore`/`notAfter` range. Reported by [Borys Tsyrulnikov](https://borystsyrulnikov.dev).

Source published
10 Nov 2026 12:00:00 UTC
Source modified
11 Nov 2026 08:45:02 UTC
Saved here
11 Nov 2026 09:25:56 UTC
Source terms
OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V4 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 14:20 UTC · 256 of 275 readable · 252 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners.