CVE-2026-58586: Image::WebP Bundled libwebp Vulnerability

CVE-2026-58586 Overview

CVE-2026-58586 affects the Perl module Image::WebP through version 0.2. The module ships with a bundled copy of libwebp 0.3.0 released on 2013-03-20. That bundled library contains multiple known vulnerabilities, including CVE-2023-4863, a heap buffer overflow in WebP image decoding.

Image::WebP does not link to the system libwebp. The vulnerable decoder is compiled directly into the module. Any Perl application that passes untrusted WebP data to Image::WebP reaches the bundled decoder. Upgrading the operating system libwebp package does not remediate the flaw.

Critical Impact
Remote attackers can trigger heap corruption in the bundled libwebp decoder by supplying a crafted WebP image, enabling code execution in the context of the Perl process.

Affected Products

Image::WebP for Perl, versions through 0.2
Bundled libwebp 0.3.0 (2013-03-20 release) compiled into the module
Any Perl application decoding untrusted WebP images through Image::WebP

Discovery Timeline

2026-07-24 - CVE-2026-58586 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-58586

Vulnerability Analysis

The vulnerability arises from software supply chain exposure. Image::WebP embeds a decade-old copy of libwebp inside its distribution rather than linking against the system-provided shared library. The bundled version 0.3.0 predates disclosure of several memory corruption issues in WebP handling, most notably CVE-2023-4863, a heap buffer overflow in the BuildHuffmanTable routine of libwebp's lossless decoder.

An attacker who controls WebP image bytes reaching Image::WebP can drive the decoder into out-of-bounds heap writes. Successful exploitation of CVE-2023-4863 has been demonstrated to achieve arbitrary code execution in browser and image-processing contexts. In a Perl service that decodes user-uploaded WebP files, the same primitive executes inside the interpreter process.

Because the flawed code is statically compiled into the module, the vulnerability persists regardless of the host system's patched libwebp. Operators cannot remediate through OS package updates.

Root Cause

The root cause is a vendored dependency that was never refreshed. Image::WebP 0.2 continues to ship libwebp 0.3.0 from 2013. All memory corruption defects fixed in libwebp after that release remain reachable through the module's decoding interface.

Attack Vector

Exploitation is remote and requires no authentication or user interaction beyond causing the target application to decode attacker-supplied WebP data. Common entry points include image upload endpoints, thumbnail generators, content ingestion pipelines, and mail or messaging processors built on Perl. See the MetaCPAN release source tree and the CVE-2023-4863 record for the underlying decoder details.

Detection Methods for CVE-2026-58586

Indicators of Compromise

Crashes or segmentation faults in Perl processes shortly after WebP image ingestion.
Unexpected child processes or outbound network connections spawned by Perl workers that handle image uploads.
WebP files with malformed VP8L chunks or oversized Huffman code length tables in web upload logs.

Detection Strategies

Inventory Perl deployments for Image::WebP by searching @INC paths and CPAN metadata for the module and its bundled webp-src directory.
Flag any installation where Image::WebP version is less than or equal to 0.2, regardless of the system libwebp version.
Inspect WebP payloads at ingress with a scanner built against a current libwebp to reject malformed VP8L streams.

Monitoring Recommendations

Monitor Perl worker memory and exit codes on services that accept image uploads for signs of decoder crashes.
Log process ancestry for Perl-based image handlers to identify anomalous execution following WebP decoding.
Alert on new outbound connections initiated by Perl processes tied to image processing queues.

How to Mitigate CVE-2026-58586

Immediate Actions Required

Identify all systems running Image::WebP 0.2 or earlier and treat any WebP decoding path as untrusted.
Route WebP decoding through an isolated sandbox or a separate process built on a current libwebp.
Reject WebP uploads at the application boundary until an updated Image::WebP release is deployed.

Patch Information

No fixed release of Image::WebP is referenced in the advisory data. Track the module's MetaCPAN page for a version that either updates the bundled libwebp past the fixes for CVE-2023-4863 and related issues, or removes the bundled copy in favor of the system library.

Workarounds

Replace Image::WebP with a Perl binding that links dynamically to the system libwebp, then keep the OS package current.
Pre-validate WebP files with a hardened decoder before passing bytes to Image::WebP, and reject inputs that fail strict conformance checks.
Run Perl image workers under a restrictive seccomp or AppArmor profile to reduce the impact of successful decoder exploitation.

bash

# Configuration example
# Locate vulnerable Image::WebP installations across a fleet
perl -MImage::WebP -E 'say $Image::WebP::VERSION' 2>/dev/null
find / -type d -name 'Image' 2>/dev/null | xargs -I{} ls {}/WebP.pm 2>/dev/null