A data race in the lock‑free insertion of events into the event_queue can corrupt the heap in EVerest's everest-core component, as observed by tools such as TSAN and ASAN. The corruption may lead to application crashes or, depending on how the corrupted memory is used, to further control of the process. The weakness is a classic heap buffer corruption (CWE‑122).

The vulnerability affects EVerest everest‑core versions released before 2026.02.0. Any deployment of EVerest that has not been updated to 2026.02.0 or later is susceptible. The specific trigger occurs when a powermeter public key update is processed together with EV session or error events while the OCPP interface has not yet started.

The CVSS base score is 5.9, indicating moderate severity. No EPSS information is available and the issue is not listed in CISA’s KEV catalog. The attack vector is likely internal, requiring the EV charging system to perform the constrained sequence of events (powermeter key update and EV session or error handling). Because the flaw does not expose a remote code execution path, exploitation risk is moderate but could still affect the integrity and availability of the charging station software.