CVE-2026-23955 Details
Description
EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be used by malicious operator to read unintended memory regions, including the heap and the stack. Version 2025.9.0 fixes the issue.
A vulnerability in EVerest, an EV charging software stack, prior to version 2025.9.0, allows for unintended memory reads due to improper error handling. In several instances, integer values are concatenated with strings when generating error messages. This behavior leads to pointer arithmetic instead of the expected string representation of the integers, a common convention in interpreted languages. As a result, a malicious operator could exploit this flaw to access unintended memory areas, including the heap and stack.
Users can upgrade to EVerest version 2025.9.0 or later to address this vulnerability. For users of the libocpp library, version 0.30.1 or later is recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/EVerest/everest-core/security/advisories/GHSA-px57-jx97-hrff | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1046 | Creation of Immutable Text Using String Concatenation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation everest | < 2025.9.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 6, 2026 | Initial Analysis | [email protected] |
| Jan 21, 2026 | New CVE Received | [email protected] |