← Back to Intel Center

2026-11-11 Daily Security Intelligence

RSS

CSSA 2 CVE 1 Poison 0

9.8 Critical CVE-2026-61473 An authentication-bypass flaw in Intel TDX MigTD le…

CSSA Exclusive Early Warning 2

CSSA Exclusive Early Warning 9.6 Critical

An integer overflow in the stb image library causes a heap buffer overflow that damages system integrity

An attacker can exploit an integer-overflow flaw that appears when a carefully crafted 16-bit image is processed. During channel conversion, the allocation size is computed without a safety check, so the heap memory actually allocated is far smaller than the amount of data written. When the application calls the load interface and requests output in a particular color channel, malicious input triggers arithmetic wraparound and a serious heap buffer overflow, exposing the controlled process to code-execution risk and a threat of service interruption.

Component
stb_image.h is a lightweight, single-header image-processing library. It is built to give applications efficient image-decoding, and it can parse common formats including PNG, PSD, and PNM. By simplifying memory management and the decode path, it serves software systems that need to load and convert image data quickly. Its core function is to turn raw image data into a standardized pixel array for later rendering or processing.
Type
Integer Overflow or Wraparound (CWE-190)
Repo
github.com/nothings/stb Stars 34991
Remediation
  • In memory-allocation logic that multiplies image dimensions by the channel count, consistently use overflow-safe wrapper functions. Perform bounds checks on every multiplication result so the computed byte size cannot be truncated or wrap around, and thereby prevent out-of-bounds buffer writes caused by a wrong size estimate.
CSSA Exclusive Early Warning 9.6 Critical

An authentication flaw in open-mercato lets an attacker take over multi-factor authentication and fully control the account

The flaw comes from a missing critical authentication step. After obtaining a valid session, an attacker can call the MFA management interface without providing the current password or an existing authentication factor. That includes regenerating plaintext recovery codes, deleting verification methods, or using a POST request to change the email OTP delivery address to an attacker-controlled mailbox. Because the Email OTP provider does not verify that the email is genuine when confirming the setting and directly trusts data submitted by the client, the attacker can activate a verification channel that points to themselves, bypass the original multi-factor protection, and gain persistent control of the victim's account.

Component
open-mercato is an open-source enterprise collaboration platform. Its core architecture includes a security module and an enterprise extension pack, and it is meant to manage user identity and resource access through a fine-grained permission system. The system relies on session-based authentication and integrates multi-factor authentication to strengthen account security, keeping enterprise data confidential and intact in a complex network environment.
Type
Missing Critical Step in Authentication (CWE-304)
Repo
github.com/open-mercato/open-mercato Stars 1920
Remediation
  • Fix this class of flaw by requiring a fresh verification of the user's identity before sensitive operations, for example with a sudo-token mechanism or a second password check. Also tighten server-side validation so that confirming email OTP must include a unique verification code sent to the target mailbox, and forbid the client from changing the delivery address during confirmation, blocking unauthorized state changes and credential replacement at the architectural level.

CVE Intelligence 1

CVE-2026-61473 CVSS 9.8 Critical 2026-11-11

An authentication-bypass flaw in Intel TDX MigTD leads to privilege escalation

In Intel(R) TDX Migration Trust Domain (MigTD) at Ring 0, there is an authentication-bypass flaw that is achieved through capture and replay (CWE-294). The hypervisor may allow privilege escalation. A system-software attacker who is a privileged user, combined with a low-complexity attack, may achieve privilege escalation. When no special insider knowledge is required and the attack needs no user interaction, this result may occur through local access. The potential flaw may affect the confidentiality (high) and integrity (high) of a vulnerable system, with no impact on availability, and thereby lead to high impact on system confidentiality and integrity, and no impact on availability.

Component
Intel TDX (Trust Domain Extensions) is a hardware-assisted security extension from Intel, designed to provide isolation for a trusted execution environment. MigTD is a key component used to migrate trust domains.
Risks
  • From ordinary user to administrator: If the victim runs the browser with administrator privileges, the attacker can obtain the same privileges
  • Complete system control: The attacker can run arbitrary code on the victim system and, depending on user privileges, install programs, view, change, or delete data, or create new accounts with full privileges
  • Attack without user interaction: Through a Drive-by Compromise technique (T1189), the user only needs to visit a malicious web page to trigger the flaw, with no additional interaction
Source
NVD CVE-2026-61473
Remediation
  • Monitor logs for abnormal memory-access behavior
  • Enable sandbox isolation in the runtime environment
← Back to Intel CenterRSSMonitor these risks automatically with CleanSource SCA →