CVE-2026-58586: CWE-1395 Dependency on Vulnerable Third-Party Component in ZAPAD Image::WebP
Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.
AI Analysis
Technical Summary
Image::WebP up to version 0.2 bundles libwebp version 0.3.0, released in 2013, which has multiple known security issues such as CVE-2023-4863. The module does not link to the system-installed libwebp but uses the embedded vulnerable version. This dependency on an outdated third-party component (CWE-1395) means that decoding untrusted WebP images with Image::WebP can trigger vulnerabilities present in the bundled libwebp. Because the vulnerable code is compiled into the module, system-level libwebp updates do not address this risk.
Potential Impact
Applications using Image::WebP versions through 0.2 are exposed to vulnerabilities in the bundled libwebp 0.3.0 when decoding untrusted WebP images. This can lead to potential security issues inherent to the older libwebp version, including those documented in CVE-2023-4863. The impact depends on the specific vulnerabilities in the bundled library but may include memory corruption or other exploitable conditions.
Mitigation Recommendations
No official fix or patch is currently documented for this vulnerability. Since the vulnerable libwebp is statically bundled, updating the system libwebp does not mitigate the issue. Users should avoid decoding untrusted WebP images with affected versions of Image::WebP or seek updated module versions that do not bundle vulnerable libwebp components. Monitor the vendor or CPAN for any future patches or advisories.
CVE-2026-58586: CWE-1395 Dependency on Vulnerable Third-Party Component in ZAPAD Image::WebP
Description
Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Image::WebP up to version 0.2 bundles libwebp version 0.3.0, released in 2013, which has multiple known security issues such as CVE-2023-4863. The module does not link to the system-installed libwebp but uses the embedded vulnerable version. This dependency on an outdated third-party component (CWE-1395) means that decoding untrusted WebP images with Image::WebP can trigger vulnerabilities present in the bundled libwebp. Because the vulnerable code is compiled into the module, system-level libwebp updates do not address this risk.
Potential Impact
Applications using Image::WebP versions through 0.2 are exposed to vulnerabilities in the bundled libwebp 0.3.0 when decoding untrusted WebP images. This can lead to potential security issues inherent to the older libwebp version, including those documented in CVE-2023-4863. The impact depends on the specific vulnerabilities in the bundled library but may include memory corruption or other exploitable conditions.
Mitigation Recommendations
No official fix or patch is currently documented for this vulnerability. Since the vulnerable libwebp is statically bundled, updating the system libwebp does not mitigate the issue. Users should avoid decoding untrusted WebP images with affected versions of Image::WebP or seek updated module versions that do not bundle vulnerable libwebp components. Monitor the vendor or CPAN for any future patches or advisories.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-07-01T16:57:56.074Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a637ff99c2644c7f8203e22
Added to database: 07/24/2026, 15:08:41 UTC
Last enriched: 07/24/2026, 15:23:06 UTC
Last updated: 07/25/2026, 00:02:03 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.