An out-of-bounds access vulnerability in EVerest everest-core allows unauthenticated attackers to trigger a denial of service by crashing the charging software stack.

The vulnerability is a null pointer dereference (CWE-476) occurring during the deserialization of specifically crafted DC_ChargeLoopRes messages. An unauthenticated attacker can trigger this condition by providing a malicious DetailedTax vector, resulting in the termination of the EVerest process and all associated modules.

The successful exploitation of this vulnerability results in a total loss of availability for the affected EVSE charging station, as the software stack terminates upon receiving the malicious input. Given the CVSS score of 7.4, this represents a high-severity risk for infrastructure reliability, potentially leading to operational downtime and service disruption for charging networks.

Immediate Action: Update the EVerest everest-core software to version 2025.10.0 or later to include the necessary fix for the null pointer dereference.

Proactive Monitoring: Monitor system logs for unexpected process terminations or recurring errors related to the DC_ChargeLoopRes deserialization method.

Compensating Controls: Implement strict input validation or network-level filtering at the charging station interface to identify and block malformed ISO 15118-20 messages before they reach the deserialization layer.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing the EVerest software stack must prioritize the upgrade to version 2025.10.0 to remediate this denial of service risk. Because the vulnerability is reachable by unauthenticated attackers, it poses a significant threat to the stability of EV charging infrastructure and should be addressed within the standard patch management cycle.