Intel processors that support VMX non‑root guest execution can expose sensitive data owing to shared microarchitectural predictor state that influences transient execution. This vulnerability corresponds to CWE‑1423, an information disclosure flaw involving shared processor state. An local unprivileged attacker who authenticates to the host and compromises a guest VM can exploit this to read data that should remain confidential. The vulnerability delivers a high impact on confidentiality while having no effect on integrity or availability.

All Intel CPUs that implement Intel Virtualization Technology (VT‑x) and expose guest operating systems running in VMX non‑root mode are potentially vulnerable. Because the description does not list specific models, any processor that is covered by Intel SA‑01420 should be considered.

The CVSS base score of 6.8 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation remains unclear. The vulnerability is not yet listed in the CISA KEV catalog. Attacks require local host access, unprivileged guest processes, and high complexity, but they can be carried out without user interaction. Given the confidential nature of the data that can be exfiltrated, vigilance is warranted.