Which versions of Everest are affected by CVE-2026-27828?

Organizations using EVerest should be aware of moderate risk from CVE-2026-27828, a use-after-free vulnerability rated CVSS 5.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-27828?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Everest CVE-2026-27828

Q: What is the CVSS score of CVE-2026-27828?

CVE-2026-27828 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16228 MEDIUM

Use After Free (CWE-416)

2026-03-26 GitHub_M

Denial Of Service Use After Free Memory Corruption Everest Everest Core

5.5

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16228

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:34 nvd

MEDIUM 5.5

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_session_setup uses v2g_ctx after it has been freed when ISO15118 initialization fails (e.g., no IPv6 link-local address). The EVSE process can be crashed remotely by an attacker with MQTT access who issues a session_setup command while v2g_ctx has been released. Version 2026.02.0 contains a patch.

AnalysisAI

EVerest charging software stack versions prior to 2026.02.0 contain a use-after-free vulnerability in the ISO15118_chargerImpl::handle_session_setup function that crashes the EVSE process when session setup commands are issued after ISO15118 initialization failure. Remote attackers with MQTT access can trigger this denial of service condition by sending a crafted session_setup command, causing the process to reference freed memory (v2g_ctx). A vendor-released patch is available in version 2026.02.0.

Technical ContextAI

The vulnerability resides in EVerest-Core (cpe:2.3:a:everest:everest-core), a software stack for electric vehicle supply equipment (EVSE) charging management. The affected code path involves the ISO 15118 protocol implementation, which handles vehicle-to-grid (V2G) communication and session negotiation. The root cause is classified as CWE-416 (Use After Free): when ISO15118 initialization fails-for example, due to the absence of an IPv6 link-local address required by the ISO15118 standard-the v2g_ctx context pointer is deallocated. However, the handle_session_setup function fails to validate this freed state and continues to dereference the pointer when processing subsequent MQTT-delivered session_setup commands. This memory corruption condition allows attackers who possess MQTT credentials (typically network-level access) to reliably trigger a denial of service by causing the charger process to access invalid memory.

RemediationAI

Upgrade EVerest-Core to version 2026.02.0 or later, which contains the vendor-released patch. Consult the GitHub Security Advisory at https://github.com/EVerest/EVerest/security/advisories/GHSA-5g3v-qc79-qqwr for patch details and deployment guidance. Until patching is completed, restrict network access to the MQTT broker serving the EVSE process to trusted networks and authenticated clients only, implement network segmentation to isolate EV charging infrastructure from untrusted segments, monitor MQTT message logs for anomalous session_setup commands, and consider disabling ISO15118 session handling if operations can safely fall back to alternative charging protocols during the remediation window.