CVE-2026-23995: EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ
EVerest is an EV charging software stack. Prior to version 2026.02.0, stack-based buffer overflow in CAN interface initialization: passing an interface name longer than IFNAMSIZ (16) to CAN open routines overflows ifreq.ifrname, corrupting adjacent stack data and enabling potential code execution. A malicious or misconfigured interface name can trigger this before any privilege checks. Version 2026.02.0 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23995?
CVE-2026-23995 is categorized as a critical severity vulnerability due to the potential for remote code execution from a stack buffer overflow.
How do I fix CVE-2026-23995?
To fix CVE-2026-23995, update EVerest to version 2026.02.0 or later.
What type of vulnerability is CVE-2026-23995?
CVE-2026-23995 is a stack buffer overflow vulnerability affecting the CAN interface initialization in EVerest.
What are the potential impacts of CVE-2026-23995?
CVE-2026-23995 can lead to unauthorized access, control of the EV charging system, or execution of arbitrary code.
Who is affected by CVE-2026-23995?
EVerest users who are running versions prior to 2026.02.0 are affected by CVE-2026-23995.