Executive brief
Image::WebP is a Perl module used by developers to process and decode WebP images. This module includes an outdated version of a core image library (libwebp) from 2013, which contains several well-known security flaws. An attacker could provide a specially crafted image file that, when processed by a website or application using this module, could lead to system crashes or unauthorized code execution.
Technical details
Image::WebP versions through 0.2 bundle a static copy of libwebp 0.3.0 instead of linking against the system-provided library. This bundled version is susceptible to multiple vulnerabilities, most notably CVE-2023-4863 (a heap buffer overflow in the Huffman coding algorithm). Because the vulnerable code is compiled directly into the Perl module, updating the operating system's libwebp package does not mitigate the risk. An attacker can trigger these vulnerabilities by providing a malicious WebP image to any application that uses Image::WebP for decoding. No patch is currently available for the module; users are advised to migrate to alternative libraries that link against modern system libraries.
Affected products
- ZAPAD Image::WebP through 0.2
Timeline
- 2026-07-24: disclosed: CVE-2026-58586 published by CPANSec