CVE Exploitarium libarchive-zip-debuginfod-size-boundary PoC Execution

Ethan Andrews@eandrews

•updated Jul 1, 2026•1•0•2

Detects evidence of active exploitation targeting the libarchive ZIP entry declared-vs-actual size boundary vulnerability. The rule identifies the execution of known proof-of-concept (PoC) scripts (make_debuginfod_zip.py, run_stock_marker.py) as well as the creation of specific marker files or CLI output from bsdunzip/bsdtar that confirm successful boundary exploitation.