CVE Intelligence
Analysis AI-assisted

CVE-2026-27816: EVerest ISO15118 out-of-bounds write in update_energy_transfer_modes

EVerest, an EV charging software stack, contains an out-of-bounds write in its ISO15118 charger handler that can corrupt adjacent EVSE state or crash the process when oversized MQTT Cmd payloads are received. The sources state that versions before 2026.02.0 are affected and that 2026.02.0 contains a patch. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

EVerest is an EV charging software stack. According to the record, the function ISO15118_chargerImpl::handle_update_energy_transfer_modes copies a variable-length list into a fixed-size array of six elements without bounds checking. The weakness is classified as CWE-787, Out-of-bounds Write.

Impact

  • Out-of-bounds writes may corrupt adjacent EVSE state.
  • The software process may crash.
  • The description states that schema validation is disabled by default, which is the condition under which oversized MQTT Cmd payloads reach the vulnerable code.

NVD scores the issue 9.1 (critical), with high integrity and availability impact and no confidentiality impact. GitHub scores it 5.5 under the newer CVSS method. Prioritization should account for the difference between the two scores.

Affected products and versions

  • EVerest Everest-core: versions before 2026.02.0.
  • Linuxfoundation Everest: versions before 2026.02.0.

The record does not list other affected version ranges.

Exploitation status

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted. The SSVC data in the record rates exploitation as none and automatable as no. The EPSS probability is recorded as 0.00356.

Remediation and mitigation

  • Upgrade EVerest to 2026.02.0 or later, which the sources describe as containing the patch.
  • Review the GitHub Security Advisory for vendor guidance and the exact remediation path.
  • Until the upgrade is applied, restrict which publishers can reach the MQTT command topics and enable schema validation where the software allows it, since the record indicates it is disabled by default.

The fix entry in the record is typed as mitigation, so the vendor guidance should be checked to confirm what is required.

Detection guidance

  • Monitor for unusually large MQTT Cmd messages sent to EVerest components.
  • Watch for unexpected crashes or restarts of charging-related processes and for inconsistent EVSE state.
  • Log and alert on schema validation failures where validation is enabled.

Limitations of the available information

The record does not describe the full conditions under which the overflow is reachable, and it does not confirm that the patch covers every related code path. Whether deployed systems accept MQTT input from untrusted parties is unknown. The version boundary is described briefly, so the vendor advisory should be checked to confirm it.

Frequently asked questions

Is CVE-2026-27816 being exploited in the wild?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted. The record's SSVC data rates exploitation as none.

Which EVerest versions are affected and what fixes the issue?

The sources state that versions before 2026.02.0 are affected and that version 2026.02.0 contains a patch. Review the GitHub advisory for vendor guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.