Skip to main content

Image::WebP EUVDEUVD-2026-48614

| CVE-2026-58586 CRITICAL
Dependency on Vulnerable Third-Party Component (CWE-1395)
2026-07-24 CPANSec GHSA-7qv8-435q-f6x2
Information Disclosure Perl Image
9.8
CVSS 3.1 · Vendor: CPANSec
Share

Severity by source

Vendor (CPANSec) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Remote crafted image reaches the decoder with low complexity, but a victim application must decode the attacker-supplied WebP, so UI:R; memory corruption yields high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Metadata Corrected
Sep 16, 2026 - 08:40 vuln.today
tag: Perl added
Analysis Generated
Jul 27, 2026 - 17:23 vuln.today
CVSS changed
Jul 27, 2026 - 17:22 NVD
9.8 (CRITICAL)
CVE Published
Jul 24, 2026 - 15:02 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 24, 2026 - 15:02 cve.org
CRITICAL 9.8

DescriptionCVE.org

Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp.

Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863.

Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.

AnalysisAI

Bundled-dependency exposure in the Image::WebP Perl module (versions 0 through 0.2, distributed by CPAN author ZAPAD) ships a statically compiled copy of libwebp 0.3.0 from 2013, which contains multiple known decoder flaws including the critical CVE-2023-4863 heap buffer overflow. Any Perl application that uses this module to decode an attacker-supplied WebP image reaches the outdated internal decoder, potentially enabling memory corruption and remote code execution. There is no public exploit identified for this specific repackaging, EPSS is low at 0.17%, and CISA SSVC records exploitation status as none - but the embedded CVE-2023-4863 was historically a high-impact, widely-abused decoder bug.

Technical ContextAI

libwebp is Google's reference library for encoding and decoding the WebP image format; its lossless (VP8L) decoder path in versions prior to 1.3.2 mishandles Huffman-table construction, allowing an out-of-bounds heap write (CVE-2023-4863). CWE-1395 (Dependency on Vulnerable Third-Party Component) is the root-cause class here: Image::WebP does not dynamically link the system libwebp but instead vendors and statically compiles libwebp 0.3.0 (released 2013-03-20) into the compiled XS module, so the vulnerable code is baked into the .so/.bundle and cannot be superseded by OS-level libwebp updates. The affected package is identified by CPE cpe:2.3:a:zapad:image::webp (CPAN namespace ZAPAD/Image-WebP), and the bundled NEWS file referenced in the advisory documents the 0.3.0 libwebp baseline.

RemediationAI

Upgrade to Image::WebP 0.3.0 or later, whose Changes file (https://metacpan.org/release/ZAPAD/Image-WebP-0.3.0/source/Changes) documents the refreshed bundled libwebp - this is the primary fix (Vendor-released patch: Image::WebP 0.3.0). Because the vulnerable libwebp is statically compiled into the module, updating the operating system's libwebp package does NOT remediate the flaw, so a module reinstall/rebuild is mandatory. If you cannot upgrade immediately, the effective compensating control is to stop passing untrusted WebP data through this module: gate decoding behind a trusted-source check, or route WebP decoding to a system library or maintained alternative (e.g., linking the patched system libwebp ≥1.3.2) - the trade-off is code changes and possible behavioral differences in decode output. Reference the oss-security advisory at https://seclists.org/oss-sec/2026/q3/252 for context.

More in Perl

View all
CVE-2012-6329 HIGH POC
7.5 Jan 04

The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
CVE-2017-12814 CRITICAL POC
9.8 Sep 28

Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
CVE-2015-8608 CRITICAL POC
9.8 Feb 07

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
CVE-2018-18314 CRITICAL POC
9.8 Dec 07

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated

CVE-2018-18312 CRITICAL POC
9.8 Dec 05

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
CVE-2018-18313 CRITICAL POC
9.1 Dec 07

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
CVE-2016-2381 HIGH
7.5 Apr 08

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CVE-2023-31484 HIGH POC
8.1 Apr 29

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
CVE-2016-6185 HIGH POC
7.8 Aug 02

The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
CVE-2018-12015 HIGH POC
7.5 Jun 07

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
CVE-2015-8853 HIGH
7.5 May 25

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
CVE-2017-12883 CRITICAL
9.1 Sep 19

Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 al

Same weakness CWE-1395 – Dependency on Vulnerable Third-Party Component

View all
CVE-2025-15638 CRITICAL
10.0
CVE-2026-4176 CRITICAL
9.8
CVE-2025-11159 CRITICAL
9.1
CVE-2026-60455 HIGH
8.8
CVE-2026-47906 HIGH
8.6
CVE-2024-14031 HIGH
8.1
CVE-2024-14030 HIGH
8.1
CVE-2026-34652 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-48614 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy