An off-by-one vulnerability in the EVerest EV charging software stack could allow an attacker to achieve remote code execution through memory corruption.

This is a stack-based buffer overflow caused by an off-by-one error in the IsoMux certificate filename handling. The vulnerability allows an unauthenticated attacker to corrupt stack state if they can provide a crafted filename with a length equal to the maximum permitted limit.

The exploitation of this vulnerability can lead to full system compromise, including the execution of arbitrary code with the privileges of the charging stack service. Given the CVSS score of 8.4, this represents a high-severity risk that could lead to unauthorized control over critical EV charging infrastructure, resulting in operational downtime or physical safety concerns.

Immediate Action: Update EVerest everest-core to version 2026.02.0 or later to apply the necessary bounds checking fix.

Proactive Monitoring: Monitor system logs for unusual file activity or service crashes involving the IsoMux component which may indicate an exploitation attempt.

Compensating Controls: Restrict access to the filesystem directory where certificates are stored to prevent unauthorized users from placing crafted filenames that could trigger the overflow.

Public Exploit Available: Unknown.

The presence of a stack-based buffer overflow in core charging infrastructure software necessitates an urgent response. Administrators must prioritize updating to version 2026.02.0 to eliminate the flaw. Until the update is applied, ensure that access controls to the certificate directory are strictly enforced to mitigate the potential for an attacker to supply a malicious filename.