A race condition in the authentication timeout timer of EVerest Core triggers a use‑after‑free when an electric vehicle is plugged in or unplugged, or when RFID, RemoteStart, or OCPP authorization events occur—including delayed responses. The corrupted pointer may access freed memory, leading to data corruption, crashes, or unpredictable behavior, and could destabilize the stack or create conditions for further exploitation.

The vulnerable product is the EVerest Core EV charging software stack. Versions prior to 2026.02.0 are affected. The stack is deployed on Linux operating systems as part of the Linux Foundation’s Everest project and is identified by the vendor/product name EVerest:everest-core.

The CVSS score of 5.3 indicates moderate severity. An EPSS score below 1% suggests that the likelihood of real‑world exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to trigger the race condition via plug/unplug or authorization events, which could be achieved by a device that can interact with the charging station or by an authenticated user. A patch is available in version 2026.2.0.