CVE-2026-26073CWE-122

EVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queue

Medium · published March 26, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::queue`/`std::deque` corruption. The trigger is powermeter public key update and EV session/error events (while OCPP not started). This results in a TSAN data race report and an ASAN/UBSAN misaligned address runtime error being observed. Version 2026.02.0 contains a patch.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.3th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-03-26T16:15Z
EPSS history
Timeline
  • 26 MAR 16:15Z
    EVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queue
    cvelistv5