CVE-2026-58586

Deferred Deferred - Pending Action

Memory Corruption in Image::WebP Perl Module

Publication date: 2026-07-24

Last updated on: 2026-07-31

Assigner: CPANSec

Description

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-07-31

Generated

2026-08-13

AI Q&A

2026-07-24

EPSS Evaluated

2026-08-12

NVD

CVE-2026-58586

EUVD

EUVD-2026-48614

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves the Perl module Image::WebP versions through 0.2, which bundles a vulnerable version of libwebp (0.3.0 from 2013). The bundled libwebp contains known flaws, including CVE-2023-4863. Since the module uses its own copy of libwebp, updating the system libwebp does not fix the issue. Any untrusted WebP image processed by this module could trigger these vulnerabilities.

Detection Guidance

Check if Image::WebP Perl module is installed by running 'cpan -D Image::WebP'. If installed, verify the version with 'perl -MImage::WebP -e "print $Image::WebP::VERSION"'. Look for version 0.2 or earlier which bundles vulnerable libwebp.

Impact Analysis

If you use Image::WebP to decode untrusted WebP images, attackers could exploit the bundled libwebp vulnerabilities to execute arbitrary code, cause denial of service, or access sensitive data. This risk persists even if your system libwebp is updated, as the module uses its own vulnerable copy.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA if untrusted WebP images are processed, as it involves a vulnerable bundled libwebp version (0.3.0) with known security flaws like CVE-2023-4863. Failure to address this could lead to unauthorized data access or processing, violating these regulations.

Mitigation Strategies

Upgrade Image::WebP to the latest version if available. If not, avoid using Image::WebP for untrusted WebP images. Consider using system libwebp directly or alternative Perl modules that do not bundle vulnerable libwebp.

Hi! I’m here to help you understand CVE-2026-58586. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70