CVE-2026-27828 EVerest: ISO15118 session_setup use-after-free can crash EVSE process

What is CVE-2026-27828?

CVE-2026-27828 is a medium-severity use after free vulnerability in everest-core, published on 26 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118_chargerImpl::handle_session_setup uses v2g_ctx after it has been freed when ISO15118 initialization fails (e.g., no IPv6 link-local address). The EVSE process can be crashed remotely by an attacker with MQTT access who issues a session_setup command while v2g_ctx has been released. Version 2026.02.0 contains a patch.

Weakness: CWE-416

Which versions are affected by CVE-2026-27828?

It affects 1 product.

Products include Linuxfoundation Everest.

How do I fix CVE-2026-27828?

No fix has been published for CVE-2026-27828 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-27828 being exploited?

There is no known exploitation of CVE-2026-27828 in the wild and no public exploit code.

Other vulnerabilities in everest-core

• CVE-2026-22790 EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payload High 8.8
• CVE-2026-22593 EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing High 8.4
• CVE-2026-23995 EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ High 8.4
• CVE-2025-68137 EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop High 8.4
• CVE-2026-33009 EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5g3v-qc79-qqwr.