The vulnerability is an out‑of‑bounds write in the ISO 15118 session_setup handling code. An oversized MQTT command payload is copied into a fixed size array of two elements without bounds checking. The overflow can corrupt nearby memory, potentially causing the EVSE to behave incorrectly or crash. The weakness is classified as an uncontrolled buffer overrun (CWE‑787).

This flaw affects the EVerest core EV charging stack before the release dated 2026.02.0. Systems running any EVerest:everest-core version older than 2026.02.0 are vulnerable, regardless of deployment edition.

The CVSS score is 5.5, indicating a moderate impact on confidentiality, integrity, and availability. Exploitation requires the ability to send a specially crafted MQTT payload to the charging station; the attack vector is therefore remote and Internet‑accessible, as the flaw is triggered by externally received data. The EPSS score is not available and the issue has not been listed in CISA’s KEV catalog, so it is not known to have active exploits in the wild.