CVE-2026-58586

CVE-2026-58586

Critical · published July 24, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp.

Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.

Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00649 · 50.5th percentile
Published
2026-07-24T19:18Z
References (3)
https://metacpan.org/release/ZAPAD/Image-WebP-0.2/source/webp-src/NEWS · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://metacpan.org/release/ZAPAD/Image-WebP-0.3.0/source/Changes · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://www.cve.org/CVERecord?id=CVE-2023-4863 · 9b29abf9-4ab0-4765-b253-1875cd9b441e
EPSS history
Timeline
  • 24 JUL 15:02Z
    Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp
    cvelistv5