A data race exists between the handling of evccid updates and OCPP session or authorization events in the EVerest EV charging software stack. The race allows concurrent access to a std::string, which can trigger a heap use‑after‑free. The result is undefined behavior, such as application crashes or memory corruption, but the description does not specify disclosure or other impacts.

Versions of EVerest everest-core released before 2026.02.0 are affected. Any charging station or backend system running those earlier releases may experience the race condition when handling evccid updates.

The CVSS score is 4.2, indicating moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote: a malicious or compromised EV passenger or an attacker with the ability to send OCPP messages can trigger the race through simultaneous evccid updates and session events. No proof of exploitation is provided in the advisory.