CVE-2026-26008 EVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModes

What is CVE-2026-26008?

CVE-2026-26008 is a high-severity memory corruption vulnerability in everest-core, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have an out-of-bounds access (std::vector) that leads to possible remote crash/memory corruption. This is because the CSMS sends UpdateAllowedEnergyTransferModes over the network. Version 2026.2.0 contains a patch.

Weakness: CWE-125

Which versions are affected by CVE-2026-26008?

It affects 1 product.

Products include Linuxfoundation Everest.

How do I fix CVE-2026-26008?

No fix has been published for CVE-2026-26008 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-26008 being exploited?

There is no known exploitation of CVE-2026-26008 in the wild and no public exploit code.

Other vulnerabilities in everest-core

• CVE-2026-22790 EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payload High 8.8
• CVE-2026-22593 EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing High 8.4
• CVE-2026-23995 EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ High 8.4
• CVE-2025-68137 EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop High 8.4
• CVE-2026-33009 EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vw95-6jj7-3fv9.