CVE-2026-27813: EVerest has use-after-free in auth timeout timer via race condition
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to use-after-free. This is triggered by EV plug-in/unplug and RFID/RemoteStart/OCPP authorization events (or delayed authorization response). Version 2026.2.0 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27813?
CVE-2026-27813 is classified as a high-severity vulnerability due to the potential for use-after-free conditions that can lead to arbitrary code execution.
How do I fix CVE-2026-27813?
To mitigate CVE-2026-27813, update EVerest to version 2026.02.0 or later to resolve the use-after-free vulnerability.
What software versions are affected by CVE-2026-27813?
CVE-2026-27813 affects all versions of EVerest prior to 2026.02.0.
What causes the vulnerability CVE-2026-27813?
CVE-2026-27813 is caused by a race condition in the auth timeout timer triggered by rapid changes in EV plug-in/unplug events and authorization processes.
Is CVE-2026-27813 being actively exploited?
As of now, there have been no confirmed reports of active exploitation of CVE-2026-27813, but potential for exploitation exists.