What is the CVSS score of CVE-2025-68137?

CVE-2025-68137 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Everest are affected by CVE-2025-68137?

Organizations using EVerest face notable risk from CVE-2025-68137, a buffer overflow vulnerability rated CVSS 8.3.

Is there a public PoC exploit available for CVE-2025-68137?

Yes, a public proof-of-concept exploit is available for CVE-2025-68137. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-68137?

Within 7 days: Identify all affected systems and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

Everest CVE-2025-68137

HIGH

Classic Buffer Overflow (CWE-120)

2026-01-21 security-advisories@github.com

Buffer Overflow Integer Overflow Everest Linuxfoundation

8.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 06, 2026 - 21:21 vuln.today

Public exploit code

CVE Published

Jan 21, 2026 - 20:16 nvd

HIGH 8.3

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in SdpPacket::parse_header() allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtracted by the header length which results in a negative value. This value is then interpreted as SIZE_MAX (or slightly less) because the expected type of the argument is size_t. Depending on whether the server is plain TCP or TLS, this leads to either an infinite loop or a stack buffer overflow. Version 2025.10.0 fixes the issue.

AnalysisAI

Technical ContextAI

Classified as CWE-120 (Classic Buffer Overflow). Affects Everest. EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in SdpPacket::parse_header() allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtracted by the header length which results in a negative value. This value is then interpreted as SIZE_MAX (or slightly less) because the expected type of the argument is size_t. Depending on whether