CVEvulnerability

CVE-2025-68141

7.4 HIGH Published 2026-01-21 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-01-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weaknesses
CWE-476

Description

EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes` message that includes Receipt as well as TaxCosts, the vector `<DetailedTax>tax_costs` in the target `Receipt` structure is accessed out of bounds. This occurs in the method `template <> void convert(const struct iso20_dc_DetailedTaxType& in, datatypes::DetailedTax& out)` which leads to a null pointer dereference and causes the module to terminate. The EVerest processes and all its modules shut down, affecting all EVSE. Version 2025.10.0 fixes the issue.

Affected configurations

• linuxfoundation everest (< 2025.10.0)

Related

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References