EVerest is an electric vehicle charging software stack. In releases before 2025.9.0, the code concatenates literal strings with integer values when throwing errors. This incorrect concatenation causes pointer arithmetic instead of printing the integer, enabling a malicious operator to read unintended memory regions such as the stack or heap. This can expose sensitive data or facilitate further exploitation.

The vulnerability affects EVerest everest-core on the Linux Foundation EV charging platform, specifically all versions released prior to 2025.9.0. Upgrading to 2025.9.0 or later eliminates the affected code path.

The CVSS score of 4.2 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to be an operator or otherwise able to trigger error conditions that exercise the vulnerable string concatenation; once achieved, they can read arbitrary memory. While the impact does not provide direct remote code execution, the information disclosure risk could aid lateral movement or credential compromise if privileged data is leaked.