Skip to main content
HIGH

CVE-2025-68137

EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop

CVSS v3

8.3

HIGH

EPSS Score

1.3 %

exploit probability, as of 2026-09-25

CISA KEV

No

known exploited

Exploitation

poc

SSVC status

Description

EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtracted by the header length which results in a negative value. This value is then interpreted as `SIZE_MAX` (or slightly less) because the expected type of the argument is `size_t`. Depending on whether

Technical details

Published
2026-01-21
Last Modified
2026-02-06
Exploit-DB
EDB-52679

Frequently asked questions

What is CVE-2025-68137?

EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtracted by the header length which results in a negative value. This value is then interpreted as `SIZE_MAX` (or slightly less) because the expected type of the argument is `size_t`. Depending on whether

Is CVE-2025-68137 actively exploited?

A proof-of-concept exploit exists for CVE-2025-68137, but active exploitation has not been confirmed at this time.

What is the CVSS score for CVE-2025-68137?

CVE-2025-68137 has a CVSS v3 base score of 8.3 (HIGH severity).

Is CVE-2025-68137 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEsSIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2025 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database