EVerest's ISO15118 update_energy_transfer_modes overflow can corrupt EVSE state
Résumé
EVerest's ISO15118 update_energy_transfer_modes overflow can corrupt EVSE state
Description d'origine
La description telle que publiée par la source (souvent en anglais).
EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_update_energy_transfer_modes copies a variable-length list into a fixed-size array of length 6 without bounds checking. With schema validation disabled by default, oversized MQTT Cmd payloads can trigger out-of-bounds writes and corrupt adjacent EVSE state or crash the process. Version 2026.02.0 contains a patch.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov