CVE-2026-9149 — Libsolv Buffer Overflow

title: CVE-2026-9149 - Libsolv Heap Buffer Overflow via crafted .solv file
id: scw-2026-05-21-ai-1
status: experimental
level: critical
description: |
  Detects the creation of .solv files, which is the initial vector for CVE-2026-9149. This rule specifically looks for the creation of files with the .solv extension, indicating a potential attempt to exploit the libsolv heap buffer overflow vulnerability by processing a specially crafted file.
author: SCW Feed Engine (AI-generated)
date: 2026-05-21
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-9149/
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
    category: file_event
detection:
  selection:
      TargetFilename|endswith:
          - '.solv'
  selection_indicators:
      EventType|exact:
          - 'create'
      condition: selection AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse