EVerest’s event queue includes a lock‑free insertion routine that suffers from a data race. When a powerMeter public‑key update occurs concurrently with an EV session or error event before OCPP has started, the race corrupts std::queue or std::deque objects, causing heap corruption. The corruption is observed as runtime failures reported by TSAN, ASAN, or UBSAN and can lead to application crashes.

EVerest Core versions released before 2026.02.0 are affected, including any EV charging deployments that use the everest‑core product prior to that patch.

The CVSS score of 5.9 indicates moderate severity. An EPSS score below 1 % suggests exploitation in the wild is currently low. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a specific sequence of events—triggering a power‑meter public‑key update followed by an EV session or error event while OCPP is not yet active—which indicates a targeted scenario, though the exact attack vector is not explicitly stated.