Which versions of Everest Core are affected by CVE-2026-27816?

Organizations using EVerest should be aware of moderate risk from CVE-2026-27816, a out-of-bounds write vulnerability rated CVSS 5.5.. A patch is available.

Everest Core CVE-2026-27816

Q: What is the CVSS score of CVE-2026-27816?

CVE-2026-27816 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16226 MEDIUM

Out-of-bounds Write (CWE-787)

2026-03-26 GitHub_M

Buffer Overflow Memory Corruption Everest Core

5.5

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16226

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:32 nvd

MEDIUM 5.5

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_update_energy_transfer_modes copies a variable-length list into a fixed-size array of length 6 without bounds checking. With schema validation disabled by default, oversized MQTT Cmd payloads can trigger out-of-bounds writes and corrupt adjacent EVSE state or crash the process. Version 2026.02.0 contains a patch.

AnalysisAI

EVerest-Core prior to version 2026.02.0 contains an out-of-bounds write vulnerability in the ISO15118_chargerImpl::handle_update_energy_transfer_modes function, where variable-length MQTT command payloads are copied into a fixed-size 6-element array without bounds checking. When schema validation is disabled by default, oversized payloads trigger memory corruption that can crash the EV charging service or corrupt adjacent EVSE (Electric Vehicle Supply Equipment) state, affecting the integrity and availability of EV charging infrastructure. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	The CVSS v4.0 base score of 5.5 with vector AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N indicates local attack vector with low complexity, no privileges or user interaction required, resulting in high availability impact (service crash) but no direct confidentiality or integrity compromise of other security domains. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with network access to an EVerest-Core MQTT broker (or who has compromised a legitimate MQTT client) crafts an oversized energy_transfer_modes list payload in an ISO15118 Cmd message containing more than 6 mode entries. When the charger processes this message with schema validation disabled, the handle_update_energy_transfer_modes function copies the entire list into the fixed 6-element array, overwriting adjacent EVSE state variables in memory. …
Remediation	Upgrade EVerest-Core to version 2026.02.0 or later, which contains the patch for the out-of-bounds write vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.