EVerest 1.6 and earlier versions contain a concurrency flaw where simultaneous updates to the EV state‑of‑charge (SoC) map and power‑meter readings lead to corruption of a std::map holding optional entries. The defect is a classic data‑race (CWE‑362) that may cause the map to become inconsistent, potentially resulting in application crashes, unpredictable behavior, or denial of service of the charging station software. No direct exploitation path is described in the source, but the inconsistency can crash the server or drop charging sessions.

The vulnerable component is the everest-core stack of EVerest, the open‑source electric‑vehicle charging software. All releases before version 2026.02.0 are affected; version 2026.02.0 includes the fix.

The CVSS score of 4.2 indicates moderate severity, and the EPSS score is below 1 %, suggesting a low estimated exploitation probability. The vulnerability is not listed in the CISA KEV catalog, reinforcing the low threat level. The likely attack vector is local access or an attacker that can induce concurrent SoC updates from the vehicle and periodic power‑meter updates while the vehicle is unplugged or the session is finished. Inferences indicate that an attacker would need direct or privileged interaction with the EVSE to trigger the race, making remote exploitation unlikely under normal conditions.