CVE-2026-23955: EVerest Information Disclosure Vulnerability

CVE-2026-23955 Overview

CVE-2026-23955 is a memory information disclosure vulnerability in EVerest, an open-source EV charging software stack. The vulnerability exists in error handling code where integer values are incorrectly concatenated to literal strings. Due to the nature of C/C++ pointer arithmetic, this implementation flaw results in unintended memory reads rather than the intended string representation of integer values. A malicious operator with local access could exploit this vulnerability to read sensitive memory regions, including the heap and stack.

Critical Impact

Exploitation allows unauthorized reading of sensitive memory regions including heap and stack data, potentially exposing credentials, cryptographic keys, or other sensitive information processed by the EV charging infrastructure.

Affected Products

• EVerest everest-core versions prior to 2025.9.0
• EV charging stations and infrastructure utilizing affected EVerest software stack
• Deployments running unpatched EVerest implementations

Discovery Timeline

• 2026-01-21 - CVE CVE-2026-23955 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-23955

Vulnerability Analysis

This vulnerability falls under CWE-1046 (Creation of Immutable Text Using String Concatenation). The flaw occurs in multiple locations within the EVerest codebase where error handling routines construct error messages by concatenating integer values with string literals.

In compiled languages like C/C++, when an integer is added to a string literal (which decays to a pointer), the compiler interprets this as pointer arithmetic rather than string concatenation. Instead of appending the string representation of the integer to the error message, the operation advances the string pointer by that integer value, causing the program to read from an unintended memory location.

This behavior differs significantly from interpreted languages where similar syntax would result in string conversion and concatenation. The mismatch between developer expectation (interpreted-language behavior) and actual behavior (pointer arithmetic) creates the security vulnerability.

Root Cause

The root cause is improper string handling in C/C++ error construction code. When throwing errors, developers used direct addition of integer values to string literals, expecting the integers to be converted to their string representation. However, in C/C++, adding an integer to a char* pointer performs pointer arithmetic, advancing the pointer by that many bytes rather than concatenating the integer's string representation.

Attack Vector

The attack requires local access with high privileges (operator-level access). A malicious operator can trigger error conditions with controlled integer values, causing the software to read from arbitrary memory offsets relative to the original string literal's location. By carefully crafting the integer values used in error generation, an attacker can:

1. Trigger specific error handling paths in the application
2. Control the integer value that gets added to string pointers
3. Cause the application to read and potentially expose memory contents from heap or stack regions
4. Extract sensitive information such as credentials, session tokens, or internal state data

The vulnerability requires user interaction (the operator must actively trigger error conditions) and is limited to local access scenarios typical in EV charging infrastructure management contexts.

Detection Methods for CVE-2026-23955

Indicators of Compromise

• Unusual error messages containing unexpected or garbled characters in EVerest logs
• Error messages displaying memory content that appears as random data or binary fragments
• Repeated triggering of specific error conditions by operator accounts
• Log entries showing abnormal string content in exception handling paths

Detection Strategies

• Monitor EVerest application logs for malformed or suspicious error message content
• Implement anomaly detection for operator actions that repeatedly trigger error conditions
• Review authentication logs for unusual patterns of privileged access to charging infrastructure
• Deploy memory access monitoring tools to detect out-of-bounds read operations

Monitoring Recommendations

• Enable verbose logging on EVerest deployments to capture error handling activity
• Implement SIEM rules to alert on unusual error message patterns in EV charging infrastructure
• Monitor for repeated error triggering behavior that may indicate exploitation attempts
• Conduct regular log analysis focusing on error handling paths and exception data

How to Mitigate CVE-2026-23955

Immediate Actions Required

• Upgrade EVerest everest-core to version 2025.9.0 or later immediately
• Audit operator access logs for any suspicious error-triggering activity
• Review and restrict operator privileges to minimize potential exploitation impact
• Implement network segmentation to isolate EV charging infrastructure from untrusted networks

Patch Information

The vulnerability is fixed in EVerest version 2025.9.0. The patch addresses the improper string concatenation by implementing proper integer-to-string conversion before constructing error messages. Organizations should upgrade to the patched version as soon as possible. For detailed patch information, see the GitHub Security Advisory.

Workarounds

• Restrict operator access to trusted personnel only until patching is complete
• Implement additional access controls and monitoring on EVerest management interfaces
• Consider disabling verbose error reporting in production environments as a temporary measure
• Deploy network-level controls to limit access to EVerest management functions
• Enable audit logging for all operator activities to detect potential exploitation attempts

Note: These workarounds reduce risk but do not fully mitigate the vulnerability. Upgrading to version 2025.9.0 is the recommended remediation.