CVE-2026-58586

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-25)

Published

2026-07-24

Modified

2026-10-24

Record from

the NVD, synced 2026-10-24

References

• https://metacpan.org/release/ZAPAD/Image-WebP-0.2/source/webp-src/NEWS
• https://metacpan.org/release/ZAPAD/Image-WebP-0.3.0/source/Changes
• https://www.cve.org/CVERecord?id=CVE-2023-4863

Check your stackJSON