{"id":"CVE-2026-58586","aliases":["EUVD-2026-48614","GHSA-7qv8-435q-f6x2"],"status":"published","title":"Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp","description":"Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp.\n\nImage::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.\n\nAny caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00649,"percentile":0.51418,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1395"],"published":"2026-07-24T15:02:22Z","modified":"2026-10-24T13:10:00Z","products":[{"vendor":"zapad","product":"image::webp"}],"references":[{"url":"https://metacpan.org/release/ZAPAD/Image-WebP-0.2/source/webp-src/NEWS","tags":["release-notes"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4863","tags":["vendor-advisory","related"]},{"url":"https://metacpan.org/release/ZAPAD/Image-WebP-0.3.0/source/Changes","tags":["release-notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58586"},{"url":"https://github.com/advisories/GHSA-7qv8-435q-f6x2"}],"sources":{"cve":[{"id":"CVE-2026-58586","title":"Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp","description":"Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp.\n\nImage::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.\n\nAny caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.","status":"published","published":"2026-07-24T15:02:22.783Z","modified":"2026-07-31T19:19:15.967Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-48614","description":"Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp.\n\nImage::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.\n\nAny caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.","status":"published","published":"2026-07-24T15:02:22Z","modified":"2026-07-31T19:19:15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:02:25.522444Z"}],"ghsa":[{"id":"GHSA-7qv8-435q-f6x2","title":"Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp.\n\nImage::WebP...","description":"Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp.\n\nImage::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.\n\nAny caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.","status":"published","published":"2026-07-24T15:33:02Z","modified":"2026-07-31T21:31:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:10:00.950607Z"}],"nvd":[{"id":"CVE-2026-58586","description":"Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp.\n\nImage::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.\n\nAny caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.","status":"published","published":"2026-07-24T15:18:44.997Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:32.473901Z"}]}}