CVE-2026-58586: CWE-1395 Dependency on Vulnerable Third-Party Component in ZAPAD Image::WebP
Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.
AI Analysis
Technical Summary
Image::WebP versions through 0.2 for Perl bundle libwebp version 0.3.0, released in 2013, which has multiple known vulnerabilities such as CVE-2023-4863. The module does not link to the system-installed libwebp, so system updates to libwebp do not address these vulnerabilities. This creates a critical security risk when decoding untrusted WebP images, as the vulnerable decoder is directly used within the module.
Potential Impact
The vulnerability allows remote attackers to exploit multiple severe flaws in the bundled libwebp 0.3.0 library when untrusted WebP images are decoded. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system, as indicated by the CVSS score of 9.8 with high impact on all security properties.
Mitigation Recommendations
No official patch or remediation is currently confirmed for this vulnerability. Since the module bundles a fixed version of libwebp internally, upgrading the system libwebp does not mitigate the issue. Users should monitor the vendor or CPAN security advisories for updates or consider avoiding use of Image::WebP versions through 0.2 until a fixed version is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-58586: CWE-1395 Dependency on Vulnerable Third-Party Component in ZAPAD Image::WebP
Description
Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.
CVSS v3.1
Score 9.8critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Image::WebP versions through 0.2 for Perl bundle libwebp version 0.3.0, released in 2013, which has multiple known vulnerabilities such as CVE-2023-4863. The module does not link to the system-installed libwebp, so system updates to libwebp do not address these vulnerabilities. This creates a critical security risk when decoding untrusted WebP images, as the vulnerable decoder is directly used within the module.
Potential Impact
The vulnerability allows remote attackers to exploit multiple severe flaws in the bundled libwebp 0.3.0 library when untrusted WebP images are decoded. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system, as indicated by the CVSS score of 9.8 with high impact on all security properties.
Mitigation Recommendations
No official patch or remediation is currently confirmed for this vulnerability. Since the module bundles a fixed version of libwebp internally, upgrading the system libwebp does not mitigate the issue. Users should monitor the vendor or CPAN security advisories for updates or consider avoiding use of Image::WebP versions through 0.2 until a fixed version is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-07-01T16:57:56.074Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a637ff99c2644c7f8203e22
Added to database: 07/24/2026, 15:08:41 UTC
Last enriched: 07/31/2026, 21:05:47 UTC
Last updated: 09/07/2026, 22:52:13 UTC
Views: 93
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.