CVE-2026-33009: EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to C++ UB (potential memory corruption). This is triggered by an MQTT everestexternal/nodered/{connector}/cmd/switchthreephaseswhilecharging message and results in Charger::sharedcontext / internalcontext accessed concurrently without lock. Version 2026.02.0 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33009?
CVE-2026-33009 is classified as a high-severity vulnerability due to its potential to cause memory corruption.
How do I fix CVE-2026-33009?
To mitigate CVE-2026-33009, update your EVerest software to version 2026.02.0 or later.
What software is affected by CVE-2026-33009?
CVE-2026-33009 affects all versions of EVerest prior to 2026.02.0.
What type of vulnerability is CVE-2026-33009?
CVE-2026-33009 is a data race vulnerability that can lead to undefined behavior in C++.
What is the cause of CVE-2026-33009?
CVE-2026-33009 is caused by a data race triggered by an MQTT command in the EVerest software.