Introduction
Privilege escalation flaws in server CPUs can undermine trusted execution and confidential computing in enterprise and cloud environments. CVE-2025-32086 affects Intel Xeon 6 processors. It is a security gap in DDRIO configuration that applies when Intel SGX or TDX is in use. The vulnerability is rated high severity (CVSS 7.2), and it matters to any organization that relies on hardware-based isolation for sensitive workloads.
Intel is the dominant supplier of server processors worldwide, and Xeon CPUs run a large share of data center and enterprise infrastructure. Intel SGX (Software Guard Extensions) and TDX (Trust Domain Extensions) are widely used for confidential computing and trusted execution, so a vulnerability in either feature is a priority for security teams.
Technical information
CVE-2025-32086 is caused by an improperly implemented security check for standard in the DDRIO configuration of Intel Xeon 6 processors. DDRIO (Data Direct I/O) lets I/O go directly to the processor cache, bypassing main memory to improve performance. When SGX or TDX is enabled, the flawed check may allow a privileged local user to escalate privileges by getting around the isolation or validation mechanisms that protect secure enclaves and trust domains.
The vulnerability is classified under CWE-358 (Improperly Implemented Security Check for Standard), which means the processor does not correctly enforce the security boundaries the protocol specifies. Exploitation requires local privileged access. As of the advisory date, no public exploit details, code snippets, or detection methods were available.
Affected systems and versions
- Intel Xeon 6 processors
- Vulnerable when DDRIO is configured and either Intel SGX or Intel TDX is enabled
- Public sources give no further version or SKU details
Vendor security history
Intel has had earlier hardware security issues in similar subsystems, including:
- CVE-2024-48869: Improper restriction of software interfaces to hardware features in Xeon 6 with TDX or SGX
- NetCAT (CVE-2019-11184): Side-channel attack on DDIO and RDMA
- Multiple advisories in 2025 related to Xeon 6, SGX, and TDX
Intel typically responds with microcode updates. The repeat appearances of issues like these show how hard it remains to secure complex CPU features.
