CVE-2026-58586

CRITICAL

Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-58586. PoCs published by extratao.

AI-analyzed exploit summary This repository provides a technical analysis of CVE-2026-58586, a vulnerability in the `Image::WebP` Perl module (versions ≤0.2) caused by bundling an obsolete libwebp decoder. The writeup details the migration path to `Imager::File::WEBP`, explains the vulnerability's root cause (bundled outdated libwebp), and clarifies that system libwebp updates do not remediate the issue.

Description

Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.

Exploits (1)

nomisec WRITEUP
by extratao · poc
https://github.com/extratao/Image-WebP

This repository provides a technical analysis of CVE-2026-58586, a vulnerability in the `Image::WebP` Perl module (versions ≤0.2) caused by bundling an obsolete libwebp decoder. The writeup details the migration path to `Imager::File::WEBP`, explains the vulnerability's root cause (bundled outdated libwebp), and clarifies that system libwebp updates do not remediate the issue.

Classification
Writeup 98%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Image::WebP (Perl module) versions through 0.2
No auth needed
Prerequisites: Use of vulnerable `Image::WebP` module (≤0.2) to decode untrusted WebP images
mistral-large-3 · analyzed Jul 28, 2026 Full analysis →

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory related
https://www.cve.org/CVERecord?id=CVE-2023-4863

Scores

CVSS v3 9.8
EPSS 0.0036
EPSS Percentile 28.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-1395
Status published
Products (1)
ZAPAD/Image::WebP < 0.2
Published Jul 24, 2026
Tracked Since Jul 24, 2026