wbond certvalidator CVE-2026-109144

Exploitation requires that the deploying application pass attacker-controlled X.509 certificates or certificate chains into certvalidator's Certificate Path Builder - e.g., TLS mutual-authentication client certs, PKCS#7/document signature verification, or any flow that validates externally supplied chains. The flaw is limited to availability degradation (VA:L) with no data exposure, and real-world reachability depends on whether cert input is exposed to untrusted sources over the network versus processed only from trusted/offline inputs; against applications that never validate external certificates, the vector is not remotely reachable. No authentication or user interaction is required per the provided vector (PR:N/UI:N).

This is a denial-of-service (CWE-400, resource consumption) flaw in the Certificate Path Builder of wbond certvalidator ≤0.11.1. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated trigger, but the only impact is low availability (VA:L) with no confidentiality or integrity effect - hence the moderate 6.9 score. Exploitation signals are weak: there is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided, so there is no evidence of active or automated exploitation. SSVC-style reasoning puts this at partial/limited technical impact (availability degradation only) rather than total compromise. The AV:N rating is plausible only where the library validates attacker-supplied certificates reachable over the network (e.g., TLS client-certificate or signature-validation paths); in batch/offline use the real vector is closer to local input and the practical reach is lower - verify against how the consuming application exposes certvalidator. Net: a genuine but low-to-moderate priority availability bug, not a high-urgency item; it ranks well below any code-execution or data-exposure CVE.

An application uses certvalidator to validate externally supplied X.509 certificate chains (for example, TLS client-certificate or document-signature verification). An attacker submits a specially crafted certificate or chain that forces the Certificate Path Builder into excessive, expensive path-building work, consuming CPU/memory and degrading or hanging the validating service. No public exploit code has been identified, but the GitHub issue (#56) suggests the condition is reproducible.