EVerest, an EV charging software stack, contains a race condition that corrupts a std::map of optional values when simultaneous EV state‑of‑charge updates, periodic power meter updates, and session termination events occur. The flaw is a classic data‑race weakness (CWE‑362) that can lead to data corruption, causing the system to report incorrect SoC or to crash, thereby compromising data integrity and availability of the charging service.

The affected component is the everest‑core module in the EVerest distribution. All releases prior to 2026.02.0 that implement the OCPP 1.6 evse_soc_map feature are vulnerable. Installations of this software stack from any vendor that bundles everest‑core are at risk.

The CVSS score of 4.2 indicates low to moderate severity. No exploitation has been documented in public catalogs or the CISA KEV list, and the EPSS score is unavailable. Exploitation would require an attacker to orchestrate the specific sequence of messages – an EV SoC update, a power‑meter periodic update, and an unplug/session finished status – which is a limited attack window and unlikely to be automated. As a result, the risk to most deployments is low unless an attacker can trigger the exact conditions.