CVE-2026-23955

EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be used by malicious operator to read unintended memory regions, including the heap and the stack. Version 2025.9.0 fixes the issue.

EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be used by malicious operator to read unintended memory regions, including the heap and the stack. Version 2025.9.0 fixes the issue.

EVerest es una pila de software de carga de VE. Antes de la versión 2025.9.0, en varios lugares, los valores enteros se concatenan a cadenas literales al lanzar errores. Esto resulta en aritmética de punteros en lugar de imprimir el valor entero como se espera, como la mayoría de los lenguajes interpretados. Esto puede ser utilizado por un operador malicioso para leer regiones de memoria no intencionadas, incluyendo el montón y la pila. La versión 2025.9.0 corrige el problema.