> If the vulnerability was embargoed until 1/1/18, does Intel have the right to reference it in a quarterly financial document before then?

The embargoes are little more than gentleman agreements and I'm not aware of _anyone_ successfully suing for their violation. Google, for instance, technically violated the agreement by disclosing before 1/9/2018. Their lawyers would have advised on any legal risk doing so had.

In comparison, Intel management is required to disclose risk factors (such as a massive f'n vulnerability) that might materially affect the stock price or risk being gone after for insider trading if they sell within the window of them acquiring the knowledge and the public disclosure.

You don't get to refuse to disclose a major risk factor, announce a sale, and sell, then announce the problem once you have unloaded all your shares. That is basically the definition of insider trading.

Right? No. Duty? Yes. They need not descibe details but can say: "big secret problem, working on it. Mitigations will be ready before public disclosure. Stock at risk should we not be ready in time."