EVerest is an electric‑vehicle charging software stack which, before version 2026.02.0, copies the variable‑length payment_options list from the ISO15118 session_setup message into a fixed‑size array of two elements without performing bounds checking. An attacker that can send a crafted MQTT command can lead the copy routine to write past the array boundary, overwriting adjacent memory. The overwrite can corrupt the EVSE state or cause the process to crash. This issue is a classic out‑of‑bounds write (CWE‑787).

The vulnerability affects all EVerest everest‑core installations with a version older than 2026.02.0. No specific hardware or operating‑system constraints are mentioned; the software stack runs on Linux‑based platforms as indicated by the corresponding CPE.

The CVSS score of 5.5 indicates moderate severity, but the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, implying a low likelihood of widespread exploitation. The attack vector is inferred to be remote, as the overflow is triggered by oversized MQTT command payloads that an attacker can inject into the communication channel between the electric‑vehicle and the charging station. Successful exploitation would lead to integrity and availability problems for the charging infrastructure but does not provide remote code execution or privilege escalation.