An off‑by‑one segmentation occurs in the IsoMux certificate filename parser when a filename reaches the maximum allowed length of 100 characters. The overflow corrupts a stack variable, which can be leveraged to alter execution flow and potentially execute arbitrary code. The weakness is a classic buffer overflow flaw (CWE‑193).

All installations of the EVerest everest‑core component running a version earlier than 2026.02.0 are affected, as the vulnerability exists within the certificate handling logic used on electric vehicle charging stations.

The CVSS score of 8.4 signals high severity, and while no EPSS data or KEV listing is available, the vulnerability can be exploited as soon as an attacker can supply a crafted filename to the certificate directory. The ability to place such a file is not explicitly documented in the description, but it is inferred that write access to the directory enables exploitation. Consequently, the risk to confidentiality, integrity, and availability is significant for systems running the vulnerable EVerest build.