What is the CVSS score of CVE-2026-26073?

CVE-2026-26073 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Everest Core are affected by CVE-2026-26073?

Organizations using EVerest should be aware of moderate risk from CVE-2026-26073, a heap-based buffer overflow vulnerability rated CVSS 5.9.. A patch is available.

How to fix or mitigate CVE-2026-26073?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Everest Core CVE-2026-26073

EUVD-2026-16216 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-03-26 GitHub_M

Heap Overflow Buffer Overflow Everest Core

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16216

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:15 nvd

MEDIUM 5.9

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible std::queue/std::deque corruption. The trigger is powermeter public key update and EV session/error events (while OCPP not started). This results in a TSAN data race report and an ASAN/UBSAN misaligned address runtime error being observed. Version 2026.02.0 contains a patch.

AnalysisAI

EVerest charging software stack versions prior to 2026.02.0 suffer from a data race condition in queue/deque handling triggered by concurrent powermeter public key updates and EV session/error events, resulting in heap corruption and potential denial of service. Unauthenticated remote attackers can exploit this via specially timed network events to crash the charging infrastructure, though successful exploitation requires precise timing due to high attack complexity. The vulnerability affects everest-core and has been patched in version 2026.02.0.

Technical ContextAI

EVerest is an open-source EV charging software stack that manages communication protocols including OCPP (Open Charge Point Protocol). The vulnerability stems from a CWE-122 (Heap-based Buffer Overflow) class issue manifesting as a data race in C++ standard library containers (std::queue and std::deque). The root cause involves unsynchronized concurrent access to shared queue structures during powermeter key material updates and EV session state transitions, particularly when the OCPP protocol handler has not yet initialized. Thread sanitizer (TSAN) detects the race condition, while address sanitizer (ASAN) and undefined behavior sanitizer (UBSAN) report misaligned memory access errors. The CPE designation cpe:2.3:a:everest:everest-core identifies the affected product family across all vulnerable versions prior to 2026.02.0.

RemediationAI

Upgrade EVerest (everest-core) to version 2026.02.0 or later, which contains the patch addressing the data race condition. This is the primary and definitive remediation. Organizations unable to immediately patch should implement network segmentation to restrict EV charging station access to trusted infrastructure, disable powermeter key update functionality if operationally feasible, or implement monitoring for TSAN/ASAN runtime errors in logs as a temporary detection control. Consult the vendor advisory at https://github.com/EVerest/EVerest/security/advisories/GHSA-jf36-f4f9-7qc2 for deployment-specific guidance. Testing the patched version in a staging environment prior to production deployment is recommended given the timing-sensitive nature of the original defect.