A flaw in the ISO15118_chargerImpl module of EVerest allows an attacker to send an oversized MQTT command payload. The implementation copies this data into a fixed array of six elements without performing bounds checking, resulting in a buffer overflow (CWE‑787). The overflow can overwrite neighboring memory, corrupting EVSE state or terminating the process, which may lead to service disruption or unpredictable charging behavior.

The vulnerability affects the EVerest open‑source charging software stack, specifically the everest‑core component, on all installations running any version prior to 2026.02.0. Users operating EVerest 2026.02.0 or later are not impacted.

The CVSS base score of 5.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. The issue is not listed in the CISA KEV catalog. Exploitation requires network access to the MQTT broker and the ability to craft an oversized packet, which is feasible for an adversary with such access. Successful exploitation would likely cause denial of service or state corruption, potentially risking unsafe charging operations.