CVE-2026-13307 is a heap-based buffer overflow vulnerability in the Autel MaxiCharger AC Elite Home EV charger. It arises from insufficient validation of the length of custom USB packets before copying data into a fixed-length heap buffer. This allows an attacker with physical access to execute arbitrary code on the device without requiring authentication. The vulnerability was reported to the vendor on 2026-03-19 and publicly disclosed on 2026-07-15. The vendor has released a firmware update (V1.40.81) that addresses this issue.

Successful exploitation enables an attacker with physical access to execute arbitrary code on the EV charger, potentially compromising device integrity, confidentiality, and availability. No authentication is required, increasing the risk from local attackers. The CVSS score assigned by ZDI is 6.8, indicating a medium severity impact.

Apply the official firmware update V1.40.81 released by Autel to remediate this vulnerability. This update fixes the heap-based buffer overflow by properly validating USB packet data length. Until the update is applied, restrict physical access to the device to trusted personnel only.