CVE-2026-27828: EVerest: ISO15118 session_setup use-after-free can crash EVSE process
EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118chargerImpl::handlesessionsetup uses v2gctx after it has been freed when ISO15118 initialization fails (e.g., no IPv6 link-local address). The EVSE process can be crashed remotely by an attacker with MQTT access who issues a sessionsetup command while v2gctx has been released. Version 2026.02.0 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27828?
The severity of CVE-2026-27828 is classified as critical due to its potential to crash the EVSE process.
How do I fix CVE-2026-27828?
To fix CVE-2026-27828, upgrade to EVerest version 2026.02.0 or later.
What is the impact of CVE-2026-27828?
CVE-2026-27828 can lead to a denial of service by crashing the EVSE process during the session setup.
Which versions of EVerest are affected by CVE-2026-27828?
EVerest versions prior to 2026.02.0 are affected by CVE-2026-27828.
What causes the vulnerability in CVE-2026-27828?
CVE-2026-27828 is caused by a use-after-free error when handling session setup during ISO15118 initialization failures.