A use‑after‑free condition occurs in EVerest’s ISO15118_chargerImpl during session_setup handling when the v2g_ctx context is freed following a failed ISO15118 initialization, such as missing an IPv6 link‑local address. The freed pointer is later accessed, leading to an application crash. The vulnerability is categorized as CWE‑416 and allows an attacker to disrupt service by forcing the EVSE process to terminate.

The flaw affects the EVerest everest-core component of the EV charging software stack. All releases prior to version 2026.02.0 are vulnerable, regardless of the host operating system on which the stack is deployed, typically Linux environments.

The CVSS base score of 5.5 indicates medium severity, and the EPSS score below 1% suggests a low probability of exploitation. However, the attack vector is inferred to be remote over MQTT, meaning an adversary with MQTT access can issue a malicious session_setup command to trigger the crash. The vulnerability is not listed in CISA’s KEV catalog, but the combination of remote reachability and a crash outcome represents a significant availability risk for impacted charging stations.