Medium

Privilege Escalation in Intel Xeon 6 DDRIO Configuration with SGX/TDX

IdentifiersCVE-2025-32086CWE-358· Improperly Implemented Security…

CVE-2025-32086 is a hardware/firmware privilege escalation vulnerability affecting some Intel Xeon 6 processors on the Birch Stream server platform when Intel SGX or Intel TDX is in use. According to the provided content, the flaw is caused by an improperly implemented security check in the DDRIO configuration path. This weakness can allow a privileged local user to bypass intended security validation associated with DDRIO operation in environments using SGX enclaves or TDX trust domains, potentially undermining isolation guarantees and enabling escalation of privilege. Intel rated the issue High under CVSS v3.1 (7.2).

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation may allow a locally privileged attacker to achieve further escalation of privilege on affected systems. In environments relying on SGX or TDX for confidential computing, the flaw may weaken hardware-enforced isolation or validation protections associated with secure enclaves or trust domains, increasing risk to sensitive workloads hosted on affected Intel Xeon 6 platforms.

Mitigation

If you can’t patch tonight, do this now.

If immediate remediation is not possible, reduce exposure by limiting local privileged access to affected hosts, especially systems running workloads that depend on SGX or TDX. Restrict administrative access, minimize use of affected confidential-computing features where operationally feasible until updates are applied, and prioritize patching of exposed enterprise and cloud servers using affected Xeon 6 processors. No specific detection or workaround beyond vendor updates was provided in the supplied content.

Remediation

Patch, then assume compromise.

Apply Intel-provided microcode updates and install the latest firmware or BIOS updates made available by the system manufacturer for affected Intel Xeon 6 systems. The provided content states that Intel released microcode updates for currently supported affected processors and recommends updating to the latest firmware version from the OEM/system vendor. Follow Intel guidance associated with Security Advisory INTEL-SA-01367 and any subsequent Trusted Computing Base recovery guidance Intel publishes.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

intel security centerNews

Aug 18, 2025

INTEL-SA-01367

An improperly implemented security check in the DDRIO configuration of some Intel Xeon 6 processors when using Intel SGX or Intel TDX that may allow local privilege escalation by a privileged user.

zeropath blogNews

Aug 12, 2025

Intel Xeon 6 CVE-2025-32086: Brief Summary of DDRIO Security Check Vulnerability - ZeroPath Blog | ZeroPath

A high-severity privilege escalation vulnerability in Intel Xeon 6 processors involving DDRIO configuration when Intel SGX or Intel TDX is enabled, potentially allowing a privileged local user to circumvent isolation protections for secure enclaves or trust domains.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity