EVerest’s auth timeout timer contains a use‑after‑free race condition triggered by EV plug‑in or unplug events and by RFID or OCPP authorization actions. The flaw can corrupt memory, leading to a crash or unpredictable behavior and potentially interrupting charging operations.

The vulnerability affects the everest‑core component of the EVerest EV charging software stack in all releases earlier than version 2026.02.0. A patched version, 2026.2.0, is available.

The CVSS score of 5.3 indicates moderate severity. Because the flaw requires specific timing of authorization events, it is not trivially exploitable and no exploit probability score is available. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported. Attackers would likely need the ability to trigger plug‑in/unplug or send authorization commands to manipulate the race condition, which may be limited to operators with access to the charging station or its management interface.