Vulnerability · Published May 28, 2026 · Assigned by icscert

CVE-2026-9038Stack-based buffer overflow in XCharge C6

High 8.6

In plain English

A high-severity stack buffer overflow in C6 from XCharge. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.2%top 86.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A stack-based buffer overflow vulnerability in the charging controller’s signal-processing logic allows an attacker with physical access to the charging interface to supply message fields that exceed expected bounds. Because the input is not sufficiently validated, memory corruption may occur, which can lead to execution of unauthorized code with elevated privileges.

Affected products (as reported)

Vendor	Product	Versions
XCharge	C6	0 – before May_22_2026

Weakness: CWE-121 · Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-08 government-resource