CVE-2026-58586
Received Received - Intake

Memory Corruption in Image::WebP Perl Module

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: CPANSec

Description
Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-58586
EUVD
EUVD-2026-48614

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Perl module Image::WebP versions through 0.2, which bundles a vulnerable version of libwebp (0.3.0 from 2013). The bundled libwebp contains known flaws, including CVE-2023-4863. Since the module uses its own copy of libwebp, updating the system libwebp does not fix the issue. Any untrusted WebP image processed by this module could trigger these vulnerabilities.

Detection Guidance

Check if Image::WebP Perl module is installed by running 'cpan -D Image::WebP'. If installed, verify the version with 'perl -MImage::WebP -e "print $Image::WebP::VERSION"'. Look for version 0.2 or earlier which bundles vulnerable libwebp.

Impact Analysis

If you use Image::WebP to decode untrusted WebP images, attackers could exploit the bundled libwebp vulnerabilities to execute arbitrary code, cause denial of service, or access sensitive data. This risk persists even if your system libwebp is updated, as the module uses its own vulnerable copy.

Mitigation Strategies

Upgrade Image::WebP to the latest version if available. If not, avoid using Image::WebP for untrusted WebP images. Consider using system libwebp directly or alternative Perl modules that do not bundle vulnerable libwebp.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart