Everest CVE-2026-26071

The CVSS v3.1 base score of 4.2 with vector AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H indicates low to moderate severity by CVSS standards, limited to physical attack vector (P) with high complexity (H), resulting in availability impact only (denial of service). However, the SSVC decision framework from CISA provides more nuanced context: exploitation is currently listed as 'none' (not active), automatable exploitation is 'no' (requires physical proximity or specific timing conditions), and technical impact is 'partial' (DoS affecting charger availability). The combination of high complexity requirement and lack of active exploitation reports suggests this is a lower real-world priority than the CVSS score alone would indicate. The vulnerability is primarily a stability and reliability concern for charging infrastructure operators rather than an immediate security threat. The patch availability in version 2026.02.0 further reduces urgency, though the requirement for physical proximity or precise timing to trigger the race condition makes this a long-tail reliability issue rather than an exploitable security flaw in typical threat models.

In a multi-vehicle charging scenario, a race condition could be triggered when two or more electric vehicles simultaneously initiate EVCCID authentication while the charging station's OCPP backend is processing a session authorization event. If the timing aligns such that one thread updates the EVCCID string's internal buffer while another thread attempts to access or copy it, the std::string object's memory state becomes corrupted, potentially resulting in a segmentation fault or heap corruption that crashes the charging station software. Recovery requires manual restart of the charger. This scenario is difficult to trigger reliably (reflected in the high complexity rating) and requires precise timing or repeated connection attempts; no publicly available exploit code automates this triggering.