CVE-2026-58586
Critical
Description
Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.
SeverityCritical
CVSS9.8
Exploit probability—
ProductImage::WebP
PublishedJul 24, 2026
First seenJul 24, 2026
Weakness typeCWE-1395CWE-1395
How to fix
Update
- ZAPAD Image::WebP0.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ZAPAD Image::WebP | v < 0.3.0 | 0.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.