Everest EUVD-2026-16173

Local attacker must place a crafted certificate file with exactly 100-character filename in EVerest's certificate directory on affected systems running versions prior to 2026.02.0. No authentication or user interaction required. Stack-based buffer overflow enables code execution with local privileges.

The CVSS base score of 8.4 reflects high severity, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicating local attack vector, low complexity, no privileges required, and high impact across confidentiality, integrity, and availability. The local attack vector (AV:L) significantly constrains real-world exploitability compared to network-accessible vulnerabilities, requiring the attacker to have local filesystem access to the certificate directory. The PR:N designation means no authentication is required once local access is obtained. No public exploit identified at time of analysis, and no EPSS or KEV status data provided suggests this is not yet observed in active exploitation campaigns. However, the low attack complexity (AC:L) and availability of detailed technical information in the GitHub security advisory increase the likelihood of future exploit development. For EV charging infrastructure deployed in physically secured environments with restricted local access, the practical risk is moderate despite the high CVSS score. For installations where local access controls are weak or where the charging software runs on multi-tenant systems, this represents a critical risk requiring immediate patching.

An attacker with local filesystem access to the EV charging system places a specially crafted certificate file with a filename of exactly 100 characters in the certificate directory monitored by the IsoMux component. When EVerest processes this certificate during initialization or certificate refresh operations, the off-by-one check fails to reject the oversized filename, triggering a stack buffer overflow that overwrites return addresses or function pointers with attacker-controlled data, enabling arbitrary code execution with the privileges of the EVerest process. Given the local attack vector (AV:L) and low complexity (AC:L), exploitation is straightforward once filesystem access is achieved.