A data race in the EVerest EV charging software allows concurrent access to a std::string representing the EVCCID. This race can free the heap memory while another thread still references it, causing a heap‑use‑after‑free. The resulting memory corruption could crash the application or, in a worst‑case scenario, allow unpredictable execution behavior. The weakness is categorized as a data race (CWE‑362) and heap use‑after‑free (CWE‑416).

The vulnerable component is EVerest’s everest‑core stack. All releases older than version 2026.02.0 are affected. Version 2026.02.0 contains the patch that removes the race condition.

The CVSS score of 4.2 indicates moderate impact, while the EPSS score of less than 1% suggests low probability of exploitation in the current threat landscape. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would likely require an attacker to trigger simultaneous EVCCID updates and OCPP session/authorization events, implying that the attack vector is logical rather than network‑directed. The lack of a publicly known exploit further reduces immediate risk, but the potential for application instability remains.