Vulnerability Details CVE-2025-68137
EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtracted by the header length which results in a negative value. This value is then interpreted as `SIZE_MAX` (or slightly less) because the expected type of the argument is `size_t`. Depending on whether the server is plain TCP or TLS, this leads to either an infinite loop or a stack buffer overflow. Version 2025.10.0 fixes the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 4.1%
CVSS Severity
CVSS v3 Score 8.3
Products affected by CVE-2025-68137
-
cpe:2.3:o:linuxfoundation:everest:2022.11.0
-
cpe:2.3:o:linuxfoundation:everest:2022.12.0
-
cpe:2.3:o:linuxfoundation:everest:2022.12.1
-
cpe:2.3:o:linuxfoundation:everest:2023.1.0
-
cpe:2.3:o:linuxfoundation:everest:2023.10.0
-
cpe:2.3:o:linuxfoundation:everest:2023.12.0
-
cpe:2.3:o:linuxfoundation:everest:2023.2.0
-
cpe:2.3:o:linuxfoundation:everest:2023.2.1
-
cpe:2.3:o:linuxfoundation:everest:2023.3.0
-
cpe:2.3:o:linuxfoundation:everest:2023.5.0
-
cpe:2.3:o:linuxfoundation:everest:2023.6.0
-
cpe:2.3:o:linuxfoundation:everest:2023.7.0
-
cpe:2.3:o:linuxfoundation:everest:2023.8.0
-
cpe:2.3:o:linuxfoundation:everest:2023.9.0
-
cpe:2.3:o:linuxfoundation:everest:2023.9.1
-
cpe:2.3:o:linuxfoundation:everest:2024.1.0
-
cpe:2.3:o:linuxfoundation:everest:2024.10.0
-
cpe:2.3:o:linuxfoundation:everest:2024.11.0
-
cpe:2.3:o:linuxfoundation:everest:2024.2.0
-
cpe:2.3:o:linuxfoundation:everest:2024.3.0
-
cpe:2.3:o:linuxfoundation:everest:2024.3.1
-
cpe:2.3:o:linuxfoundation:everest:2024.4.0
-
cpe:2.3:o:linuxfoundation:everest:2024.5.0
-
cpe:2.3:o:linuxfoundation:everest:2024.6.0
-
cpe:2.3:o:linuxfoundation:everest:2024.7.0
-
cpe:2.3:o:linuxfoundation:everest:2024.7.1
-
cpe:2.3:o:linuxfoundation:everest:2024.8.0
-
cpe:2.3:o:linuxfoundation:everest:2024.9.0
-
cpe:2.3:o:linuxfoundation:everest:2024.9.1
-
cpe:2.3:o:linuxfoundation:everest:2024.9.2
-
cpe:2.3:o:linuxfoundation:everest:2025.1.0
-
cpe:2.3:o:linuxfoundation:everest:2025.2.0
-
cpe:2.3:o:linuxfoundation:everest:2025.3.0
-
cpe:2.3:o:linuxfoundation:everest:2025.4.0
-
cpe:2.3:o:linuxfoundation:everest:2025.4.1
-
cpe:2.3:o:linuxfoundation:everest:2025.5.0
-
cpe:2.3:o:linuxfoundation:everest:2025.6.0
-
cpe:2.3:o:linuxfoundation:everest:2025.7.0
-
cpe:2.3:o:linuxfoundation:everest:2025.8.0
-
cpe:2.3:o:linuxfoundation:everest:2025.9.0