CVE-2026-27815 is a critical out-of-bounds write (CVSS 9.1) in EVerest, an EV charging software stack. A function copies a variable-length payment options list into a fixed-size array of 2 entries without a bounds check. Version 2026.02.0 contains the patch. Upgrade, and limit who can reach the MQTT interface.
What's affected
EVerest, versions before 2026.02.0 per NVD. The GitHub advisory lists 2025.12.1 as the affected version for the everest-core package and 2026.02.0 as patched.
The affected function is handle_session_setup in the ISO15118_chargerImpl module. The record notes that schema validation is disabled by default, which is what lets oversized messages reach the vulnerable code.
How to check if you're exposed
Find the EVerest release your charger software is built from. Check the version of everest-core in your build or firmware manifest, and whether your charger vendor ships EVerest under its own version number.
If a vendor supplies the firmware, ask them directly whether their release includes the 2026.02.0 fix.
Also check how the MQTT broker is exposed. List which hosts and services can publish to the topics EVerest listens on. The record describes the trigger as an oversized MQTT command payload, so network reach to the broker decides who can try.
What to do now
- Upgrade EVerest to 2026.02.0 or later, or obtain a firmware update from your charger vendor that includes it.
- Restrict access to the MQTT broker to the components that need it, and require authentication on it.
- Check whether schema validation can be enabled in your configuration and what the advisory says about it, since the record notes it is off by default.
- Watch charger logs for process crashes or restarts, which the record lists as one result of triggering the bug.
- Track the vendor's release notes for related fixes in the same release.
Why it matters
The record describes a classic fixed-size buffer problem. The handler accepts a list whose length comes from the message, copies it into an array with room for 2 items and never checks the count. A longer list writes past the end of the array, which can corrupt neighbouring charger state or crash the process. NVD classifies the flaw as CWE-787 (Out-of-bounds Write).
Memory unsafe code on charging hardware matters because the device sits on a network and controls power. Bounds checks and schema validation at the message boundary are the two layers that stop bad input early.
Charging infrastructure and message validation
EVerest components exchange commands over MQTT. The record says schema validation is off by default, so the handler sees whatever arrives on the topic.
Treat the broker as part of your security boundary. Require authentication, limit which clients can publish, and keep it off networks that carry untrusted traffic.
Plan firmware updates with your charger vendor. Many sites run EVerest inside vendor supplied firmware, so the fix reaches you through their release, not a package you install yourself.
Both this CVE and CVE-2026-27816 are fixed in 2026.02.0, so one upgrade closes both.
Operators should also keep an inventory of which chargers run which EVerest release. Without that list, a fix like this one takes weeks to confirm across a site. Ask your vendor for a written statement of which fixes a firmware build includes.
Quick check
Is this exploitable over the internet?
The record says oversized MQTT command payloads can trigger it. Whether that is reachable depends on how the broker is exposed, so check your network setup.
What is the fixed version?
2026.02.0, per the record and the GitHub advisory.
Sources
Last reviewed: 19 October 2026.
