The flaw is in the Certificate Path Builder of wbond certvalidator versions up to 0.11.1. By manipulating certificate inputs, an attacker can force the component to consume excessive CPU and memory, effectively exhausting system resources. The weakness is captured by CWE-400 and CWE-404, both pertaining to resource exhaustion and improper error handling. The result is a denial of service that can affect any process that relies on the library.

All installations of wbond certvalidator prior to 0.11.2 are affected. The product is an open‑source certificate validation library that may be embedded in various applications. No other products or versions are known to be impacted.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can launch the exploit remotely by sending a crafted certificate chain that triggers the pathological resource consumption. Because the impact is denial of service, the risk to affected systems is significant if the library is used in production environments.