PT-2026-28335 · Everest · Everest

Finder16 · Published 2026-03-26 · Updated 2026-03-29 · CVE-2026-23995

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2026.02.0

Description EVerest is an EV charging software stack. A stack-based buffer overflow exists in the CAN interface initialization process. This occurs when an interface name exceeding IFNAMSIZ (16 characters) is passed to CAN open routines, overflowing the ifreq.ifr name buffer and potentially corrupting adjacent stack data, which could lead to code execution. A malicious or misconfigured interface name can trigger this issue before any privilege checks are performed.

Recommendations Versions prior to 2026.02.0 should be updated to version 2026.02.0 or later.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-23995

GHSA-P47C-2JPR-MPWX

Affected Products

Everest

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23995.json · Exploit
• https://github.com/EVerest/EVerest/security/advisories/GHSA-p47c-2jpr-mpwx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23995 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23995 · Vendor Advisory
• https://twitter.com/CVEnew/status/2038135182478438587 · Twitter Post
• https://twitter.com/TheHackerWire/status/2037288641396146604 · Twitter Post