CVE-2026-23955: EVerest vulnerable to concatenation of strings literal and integers
EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be used by malicious operator to read unintended memory regions, including the heap and the stack. Version 2025.9.0 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23955?
CVE-2026-23955 has been assessed to have a medium severity due to potential information leakage.
How do I fix CVE-2026-23955?
To fix CVE-2026-23955, upgrade EVerest to version 2025.9.0 or later.
What software is affected by CVE-2026-23955?
CVE-2026-23955 affects EVerest versions prior to 2025.9.0.
What issues does CVE-2026-23955 cause?
CVE-2026-23955 may lead to incorrect error messages where integer values are not displayed properly.
Is CVE-2026-23955 a remote vulnerability?
CVE-2026-23955 is not classified as a remote vulnerability, as it requires local execution to exploit.