CVE-2026-58586 - Vulnerability Details - OpenCVE

Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Zapad	Image::webp

No data.

No data.

References

Link	Providers
https://metacpan.org/release/ZAPAD/Image-WebP-0.2/source/webp-src/NEWS
https://www.cve.org/CVERecord?id=CVE-2023-4863

History

Mon, 27 Jul 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 27 Jul 2026 13:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Zapad Zapad image::webp
Vendors & Products		Zapad Zapad image::webp

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.
Title		Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp
Weaknesses		CWE-1395
References		https://metacpan.org/release/ZAPAD/Image-WebP-0.2/source/webp-src/NEWS https://www.cve.org/CVERecord?id=CVE-2023-4863

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2026-07-24T15:02:22.783Z

Updated: 2026-07-27T16:28:31.652Z

Reserved: 2026-07-01T16:57:56.074Z

Link: CVE-2026-58586

Vulnrichment

Updated: 2026-07-27T16:28:19.782Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58586", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-07-01T16:57:56.074Z", "datePublished": "2026-07-24T15:02:22.783Z", "dateUpdated": "2026-07-27T16:28:31.652Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Image-WebP", "product": "Image::WebP", "vendor": "ZAPAD", "versions": [{"lessThanOrEqual": "0.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp.\n\nImage::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.\n\nAny caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1395", "description": "CWE-1395 Dependency on Vulnerable Third-Party Component", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-24T15:02:22.783Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/ZAPAD/Image-WebP-0.2/source/webp-src/NEWS"}, {"tags": ["vendor-advisory", "related"], "url": "https://www.cve.org/CVERecord?id=CVE-2023-4863"}], "solutions": [{"lang": "en", "value": "Image::WebP has not been updated since 2013. Migrate to a different solution, such as Imager with Imager::File::WEBP."}], "source": {"discovery": "UNKNOWN"}, "title": "Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-27T16:28:25.369158Z", "id": "CVE-2026-58586", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T16:28:31.652Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-58586", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-27T16:28:25.369158Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T16:28:19.782Z"}}], "cna": {"title": "Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "ZAPAD", "product": "Image::WebP", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.2"}], "packageName": "Image-WebP", "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Image::WebP has not been updated since 2013. Migrate to a different solution, such as Imager with Imager::File::WEBP."}], "references": [{"url": "https://metacpan.org/release/ZAPAD/Image-WebP-0.2/source/webp-src/NEWS", "tags": ["release-notes"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2023-4863", "tags": ["vendor-advisory", "related"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp.\n\nImage::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.\n\nAny caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1395", "description": "CWE-1395 Dependency on Vulnerable Third-Party Component"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-24T15:02:22.783Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58586", "state": "PUBLISHED", "dateUpdated": "2026-07-27T16:28:31.652Z", "dateReserved": "2026-07-01T16:57:56.074Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-24T15:02:22.783Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}