CVE Exploitarium: libarchive debuginfod ZIP Size Boundary Bypass PoC Activity

Ethan Andrews@eandrews

•updated Jul 1, 2026•0•0•1

Detects anomalous network and file activity associated with the libarchive ZIP size boundary bypass vulnerability (Exploitarium PoC). The rule identifies processes like 'debuginfod' or 'curl' interacting with specific /buildid/*/section/ endpoints via loopback interfaces, correlated with the creation of known PoC marker files or logs in temporary directories.