CVE Feed

    Dashboard / CVE / CVE-2026-27816

    CVE-2026-27816

    EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_update_energy_transfer_modes copies a variable-length list into a fixed-size array of length 6 without bounds checking. With schema validation disabled by default, oversized MQTT Cmd payloads can trigger out-of-bounds writes and corrupt adjacent EVSE state or crash the process. Version 2026.02.0 contains a patch.

    Published:Mar 26, 2026
    Last Modified:Mar 31, 2026
    EPS:Mar 26, 2026
    EPSS Score:0.00014
    CVSS Score:9.1

    Affected Products

    Vendor
    Everest
    Product
    Everest-core
    Vendor
    Linuxfoundation
    Product
    Everest

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-787 Out-of-bounds Write

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-33015 (CVSS 5.2) — EVerest is an EV charging software stack. Prior to version 2026.02.0, even immediately after CSMS performs a R…
    CVE-2026-33014 (CVSS 5.2) — EVerest is an EV charging software stack. Prior to version 2026.02.0, during RemoteStop processing, a delayed …
    CVE-2026-33009 (CVSS 8.2) — EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to C++ UB (pote…
    CVE-2026-29044 (CVSS 5) — EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed …
    CVE-2026-27828 (CVSS 5.5) — EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118_chargerImpl::handle_session_set…
    CVE-2026-27815 (CVSS 5.5) — EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_session…
    CVE-2026-27814 (CVSS 4.2) — EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by a…
    CVE-2026-27813 (CVSS 5.3) — EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to use-after-fr…
    CVE-2026-26074 (CVSS 7) — EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `st…
    CVE-2026-26073 (CVSS 5.9) — EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `st…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High