A race condition exists in EVerest’s EV charging software stack that allows concurrent access to a std::map<std::optional> during an EV State of Charge (SoC) update, a power meter periodic update, and an unplug or SessionFinished event. The simultaneous operations can corrupt the internal container and cause the charge point to crash. The primary impact is a denial of service, disrupting the availability of the charging point for vehicles.

The vulnerability affects the EVerest everest-core software stack in all releases prior to version 2026.02.0. Versions 2026.2.0 and later contain a patch that removes the data race.

The CVSS score of 4.6 indicates moderate severity, and the EPSS score of less than 1% suggests low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker sending an EV SoC update command while the system is performing a power meter update and the vehicle is unplugged or the session is finished, triggering the race. Because the flaw does not provide remote code execution or privilege escalation, the exploitation is confined to causing a crash of the charge point. Users running affected versions should consider the risk low to moderate in a controlled environment but should still apply the fix promptly.