CVE-2026-58586
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Image::WebP for Perl versions before 0.3.0 bundle a vulnerable version of libwebp (0.3.0 from 2013). The module does not link to the system libwebp but uses its own compiled copy, which has known vulnerabilities including CVE-2023-4863. Any caller decoding an untrusted WebP image reaches the vulnerable decoder, and upgrading the system library does not fix the issue.
Risk Assessment
The organization is at risk of remote code execution or DoS attacks through processing malicious WebP images. The vulnerability can be exploited without authentication if the application accepts user-supplied images.
Recommendation
Update Image::WebP to version 0.3.0 or later, which uses a secure version of libwebp. If an update is not possible, avoid decoding untrusted WebP images.
Original NVD description (English source)
Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.