HomeLinuxfoundationCVE-2025-68137

CVE-2025-68137

HIGH
8.3CVSS
Published: 2026-01-21
Updated: 2026-02-06
AI Analysis

Description

EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtracted by the header length which results in a negative value. This value is then interpreted as `SIZE_MAX` (or slightly less) because the expected type of the argument is `size_t`. Depending on whether the server is plain TCP or TLS, this leads to either an infinite loop or a stack buffer overflow. Version 2025.10.0 fixes the issue.

CVSS Metrics

Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
adjacent network
Complexity
high
Privileges
none
User Action
none
Scope
changed
Confidentiality
high
Integrity
high
Availability
high
Weaknesses
CWE-120CWE-835

Metadata

Primary Vendor
LINUXFOUNDATION
Published
1/21/2026
Last Modified
2/6/2026
Source
NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

linuxfoundation : everest

AI-Powered Remediation

Generate remediation guidance or a C-suite brief for this vulnerability.

Executive Intelligence Brief

CVE-CVE-2025-68137 | HIGH Severity | CVEDatabase.com | CVEDatabase.com