CPANSA-Image-WebP-2026-58586: Image-WebP vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-07-24T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-07-24T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 9.8 | Severity | Critical |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp.
Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.
Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.
Vulnerabilities
CVE-2026-58586
Vulnerability DescriptionImage::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp.
Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.
Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Image-WebP less than 0.3.0 |
|
Fixed
- Image-WebP greater than or equal 0.3.0
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Image-WebP-2026-58586 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-image-webp-2026-58586.json - https://metacpan.org/release/ZAPAD/Image-WebP-0.2/source/webp-src/NEWS external
https://metacpan.org/release/ZAPAD/Image-WebP-0.2/source/webp-src/NEWS - https://metacpan.org/release/ZAPAD/Image-WebP-0.3.0/source/Changes external
https://metacpan.org/release/ZAPAD/Image-WebP-0.3.0/source/Changes - https://www.cve.org/CVERecord?id=CVE-2023-4863 external
https://www.cve.org/CVERecord?id=CVE-2023-4863 - CVE-2026-58586 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-58586
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Fri Jul 24 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/