CVE-2026-27815: EVerest: ISO15118 session_setup payment options overflow can corrupt EVSE state
EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118chargerImpl::handlesessionsetup copies a variable-length paymentoptions list into a fixed-size array of length 2 without bounds checking. With schema validation disabled by default, oversized MQTT Cmd payloads can trigger out-of-bounds writes and corrupt adjacent EVSE state or crash the process. Version 2026.02.0 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27815?
CVE-2026-27815 is classified as a high severity vulnerability due to the potential for corrupting the EVSE state.
How do I fix CVE-2026-27815?
To fix CVE-2026-27815, upgrade to the EVerest version 2026.02.0 or later.
What type of vulnerability is CVE-2026-27815?
CVE-2026-27815 is a buffer overflow vulnerability affecting the session setup payment options in EVerest.
What software is affected by CVE-2026-27815?
CVE-2026-27815 affects EVerest versions prior to 2026.02.0.
What can happen if CVE-2026-27815 is exploited?
Exploitation of CVE-2026-27815 can lead to the corruption of the Electric Vehicle Supply Equipment (EVSE) state.