CVE-2026-109144: Resource Consumption in wbond certvalidator

This vulnerability affects the wbond certvalidator software up to versions 0.11.0 and 0.11.1. It arises from an unspecified flaw in the Certificate Path Builder component, which can be manipulated remotely to cause excessive resource consumption. The CVSS 4.0 base score is 6.9, indicating a medium severity impact. The vendor was contacted but did not provide any response or remediation details. No known exploits are reported in the wild.

Successful exploitation of this vulnerability could lead to resource exhaustion on the affected system, potentially degrading service availability or causing denial of service conditions. Since the attack vector is network-based and requires no privileges or user interaction, it could be triggered remotely by an unauthenticated attacker. However, no further impact details or exploitation reports are available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor vendor channels for updates. Until a fix is released, consider limiting exposure of the certvalidator service to untrusted networks if possible.