CVE-2026-58586: Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp
Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp.
Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.
Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Image::WebP (Perl)to a version that resolves this vulnerability.Fixed in 0.3.0 - Upgrade
Upgrade
Image::WebP (Perl)to a version that resolves this vulnerability.Patch CVE-2026-58586
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58586?
CVE-2026-58586 has a risk rating of 68, indicating a medium to high severity level.
How do I fix CVE-2026-58586?
To fix CVE-2026-58586, update to a newer version of Image::WebP that does not bundle the vulnerable version of libwebp.
What products are affected by CVE-2026-58586?
CVE-2026-58586 affects versions of the Image::WebP Perl module through 0.2 that bundle a vulnerable version of libwebp.
What vulnerabilities are associated with CVE-2026-58586?
CVE-2026-58586 includes vulnerabilities found in libwebp 0.3.0, notably CVE-2023-4863.
What is the impact of CVE-2026-58586?
Organizations using Image::WebP versions through 0.2 may be at risk of exploitation due to the vulnerabilities in the bundled libwebp.