CVE-2026-58586 in Image::WebP
Summary
by MITRE • 07/24/2026
Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp.
Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.
Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/24/2026
The Image::WebP perl module presents a significant security vulnerability through its reliance on a bundled version of the libwebp library. This vulnerability stems from the module's design choice to include its own copy of libwebp rather than linking to the system-installed version, creating a persistent security risk that cannot be resolved through standard system updates. The specific vulnerable version 0.3.0 of libwebp was released in March 2013 and contains multiple known security flaws that have been documented in the CVE database. This particular version includes CVE-2023-4863, which represents a critical vulnerability within the webp image decoding functionality. The fundamental flaw lies in the module's architecture where it statically compiles the vulnerable libwebp library into the perl module itself, making it impossible for system administrators to remediate the issue by simply updating the system-wide libwebp installation. This architectural decision creates an isolated security sandbox that cannot benefit from upstream security fixes and patches.
The operational impact of this vulnerability extends far beyond simple image processing functions, as any application or service that utilizes Image::WebP to decode untrusted WebP image files becomes susceptible to remote code execution or other malicious attacks. When a caller attempts to decode a maliciously crafted WebP image file through the Image::WebP module, the bundled vulnerable decoder processes the input directly within the application's memory space, potentially allowing attackers to exploit buffer overflows, heap corruption, or other memory safety issues inherent in the outdated libwebp implementation. The vulnerability is particularly concerning because it affects any perl application that relies on this module for webp image handling, including web applications, content management systems, and automated image processing pipelines. This creates a widespread attack surface where numerous perl-based services could be compromised simply by processing untrusted image uploads or external image sources.
The security implications of this vulnerability align with several CWE categories including CWE-119 Improper Restriction of Operations within a Memory Buffer and CWE-787 Out-of-bounds Write, both of which are common in legacy image decoding libraries that have not received security updates. From an ATT&CK framework perspective, this vulnerability maps to T1203 Exploitation for Client Execution and potentially T1059 Command and Scripting Interpreter where the vulnerable module could be exploited to execute arbitrary code on target systems. The remediation approach must address the fundamental architectural flaw in how Image::WebP handles its dependencies, requiring either a complete rewrite of the module to link against system libraries or the replacement of the bundled libwebp with a secure, up-to-date version. System administrators should consider immediate mitigation strategies including restricting image upload capabilities, implementing strict input validation for webp images, and potentially removing or disabling the Image::WebP module from production environments until a patched version is available. The vulnerability demonstrates the critical importance of keeping third-party dependencies current and highlights the risks associated with static linking of vulnerable libraries in security-sensitive applications.