by Kastro
Paper/Archive/CVE-2026-58586

CVE-2026-58586

ZAPAD Image::WebP — Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.1.511 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.

Affected

ProductAffectedFixed inSource
Image::WebP< 0.3.00.3.0CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refmetacpan.org/release/ZAPAD/Image-WebP-0.2/source/webp-src/NEWSadvisorycve.org/CVERecord?id=CVE-2023-4863refmetacpan.org/release/ZAPAD/Image-WebP-0.3.0/source/Changes