What’s Vulnerable › Vulnerabilities

CVE-2026-58586: Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-24 · updated 2026-10-24
• Weakness: CWE-1395

Description

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.

Affected products

• ZAPAD Image::WebP: before 0.3.0 — fixed in 0.3.0

How to fix

Upgrade to a fixed version: ZAPAD Image::WebP 0.3.0. Check the vendor advisory for mitigations.

References

• https://metacpan.org/release/ZAPAD/Image-WebP-0.2/source/webp-src/NEWS
• https://metacpan.org/release/ZAPAD/Image-WebP-0.3.0/source/Changes
• https://www.cve.org/CVERecord?id=CVE-2023-4863

Get alerted when CVE-2026-58586 or the next vulnerability affects your stack