CVE Intelligence
Analysis AI-assisted

CVE-2026-27815: EVerest ISO15118 session_setup payment options out-of-bounds write

EVerest, an EV charging software stack, is affected by an out-of-bounds write in ISO15118_chargerImpl::handle_session_setup, where a variable-length payment_options list is copied into a fixed-size array without bounds checking. The record states that the issue is addressed in version 2026.02.0 and that schema validation is disabled by default. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

EVerest is an EV charging software stack. According to the record, the function ISO15118_chargerImpl::handle_session_setup copies a variable-length payment_options list into a fixed-size array of two entries without bounds checking. The weakness is classified as CWE-787, Out-of-bounds Write.

Impact

  • Out-of-bounds writes may corrupt adjacent EVSE state.
  • Oversized payloads may crash the process.
  • Schema validation is reported as disabled by default, which is relevant to exposure.
  • The record's NVD base score is 9.1 and its CVSS vector indicates high impact on integrity and availability and no impact on confidentiality. A GitHub score of 5.5 is also recorded under the newer CVSS standard.

Affected products and versions

  • EVerest Everest-core: versions before 2026.02.0.
  • Linux Foundation Everest entry: versions before 2026.02.0.
  • Whether other products, forks or distributions are affected is unknown from the record.

Exploitation status

The CVE is not listed in the CISA KEV catalog in the record, so active exploitation is not claimed here. No confirmed exploitation appears in the sources consulted. The record gives an EPSS probability of 0.00356 and an SSVC exploitation value of none, with automatable set to no.

Remediation and mitigation

  • Upgrade EVerest to version 2026.02.0 or later, which the record states contains the patch.
  • Review the GitHub security advisory listed in the record, which is the only referenced source.
  • The record does not describe specific interim mitigations beyond the advisory, so operators unable to upgrade quickly should consult that advisory and their vendor.
  • Limit network exposure of charger control messaging and restrict who can publish to internal command channels.

Detection guidance

  • Monitor the charging software for unexpected crashes or restarts of the relevant process.
  • Alert on unusually large messages arriving on command topics used by the charging stack.
  • Review logs around session setup for anomalous behavior, at a high level, without relying on specific payload patterns.

Limitations of the available information

  • The record does not provide detailed patch analysis or a full technical description of the fix.
  • The only fix reference is typed as mitigation, so the exact remediation scope should be confirmed in the advisory.
  • The Linux Foundation Everest entry has no further product detail.
  • NVD and GitHub scores differ, and the record does not reconcile them.
  • The EPSS date in the record should be verified against the source before relying on it.

Frequently asked questions

Which versions are affected?

According to the record, EVerest Everest-core versions before 2026.02.0 are affected, and the Linux Foundation Everest entry also lists versions before 2026.02.0.

Is this vulnerability known to be actively exploited?

The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.

What should operators do first?

Plan an upgrade to version 2026.02.0 or later, review the referenced GitHub advisory, and limit network exposure of charger control messaging.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.