What is the CVSS score of EUVD-2026-16220?

EUVD-2026-16220 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Everest are affected by EUVD-2026-16220?

Organizations using EVerest should be aware of moderate risk from CVE-2026-27813, a use-after-free vulnerability rated CVSS 5.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-16220?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Everest EUVD-2026-16220

| CVE-2026-27813 MEDIUM

Use After Free (CWE-416)

2026-03-26 GitHub_M

Information Disclosure Use After Free Memory Corruption Everest Everest Core

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Physical

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16220

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:23 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to use-after-free. This is triggered by EV plug-in/unplug and RFID/RemoteStart/OCPP authorization events (or delayed authorization response). Version 2026.2.0 contains a patch.

AnalysisAI

EVerest charging software stack versions prior to 2026.02.0 contain a data race condition leading to use-after-free memory corruption, triggered by EV plug-in/unplug events and authorization flows (RFID, RemoteStart, OCPP). Unauthenticated physical attackers with high complexity can exploit this to leak sensitive information or cause denial of service on affected charging infrastructure. No public exploit identified at time of analysis.

Technical ContextAI

EVerest-core (cpe:2.3:a:everest:everest-core:*:*:*:*:*:*:*:*) is an open-source EV charging software stack handling real-time authorization events and plug state management. The vulnerability is rooted in CWE-416 (use-after-free), a memory safety issue where freed memory is referenced after deallocation. The data race occurs during concurrent processing of EV plug-in/unplug events alongside authorization response handlers (RFID card reads, RemoteStart API calls, or OCPP authorization confirmations). Without proper synchronization primitives or state validation, rapid sequences of these events can cause one thread to deallocate a data structure while another thread still holds a reference, leading to memory corruption.

RemediationAI

Upgrade EVerest-core to version 2026.02.0 or later, which contains the patch addressing the data race condition (see vendor advisory at https://github.com/EVerest/EVerest/security/advisories/GHSA-vgmh-mmg3-22m6). Until patching is completed, restrict physical access to charging stations in high-risk environments, implement sequential rather than concurrent authorization event processing if feasible via configuration, and monitor charging station logs and system health metrics for unexpected crashes or memory errors that may indicate exploitation attempts.