Image
Monthly
We need to produce a JSON with the specified fields. Let's analyze the input data carefully. CVE ID: CVE-2026-58586 Description: Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this. CVSS Score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CWE: CWE-1395 (Dependency on Vulnerable Third-Party Component) Additional intelligence: EPSS Score: 0.17% (percentile 7%) -> low probability of exploitation. Tags: Information Disclosure, Image CPE: cpe:2.3:a:zapad:image::webp:*:*:*:*:*:*:*:* (up to 0.2) Reported by: CPANSec References: advisory to CVE-2023-4863, oss-security list, etc. No KEV mention, so not actively exploited. No POC mentioned explicitly, but since CVE-2023-4863 is an old libwebp heap buffer overflow, POCs likely exist. However, the input doesn't confirm POC availability directly for this bundled case. I'll assume POC exists for the underlying libwebp vulnerability, but for this specific CVE, public exploit may not be explicitly stated. Use careful phrasing: "publicly available exploit code exists" if we infer from the known exploit for CVE-2023-4863? The instruction: "Use POC=YES but no KEV" if POC exists. But POC isn't mentioned. However, CVE-2023-4863 is widely known, had POCs, so it's reasonable to say that exploit code exists for the underlying libwebp vulnerability, and thus for this bundled case. The description says "bundled copy of libwebp 0.3.0 has multiple known vulnerabilities, including CVE-2023-4863." That is a specific vulnerability (heap buffer overflow in WebP) with known exploits. So it's safe to say publicly available exploit code exists.
Use of an unmaintained third-party component in the Perl module Image::EPEG (through version 0.15) exposes users to any latent flaws in the bundled Epeg 0.9.0 JPEG thumbnailing library, which was last updated in 2004 and is no longer supported. Reported by CPANSec (CWE-1104), the core issue is that any JPEG-decoding vulnerability in this two-decade-old embedded library will never receive an upstream fix. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.17%), and the assigned CVSS of 9.8 appears to reflect worst-case memory-corruption potential in image parsing rather than a specific demonstrated flaw.
The TIFF decoder does not place a limit on the size of compressed tile data. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
A maliciously-crafted image can cause excessive CPU consumption in decoding. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in the image crate before 0.23.12 for Rust. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
We need to produce a JSON with the specified fields. Let's analyze the input data carefully. CVE ID: CVE-2026-58586 Description: Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this. CVSS Score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CWE: CWE-1395 (Dependency on Vulnerable Third-Party Component) Additional intelligence: EPSS Score: 0.17% (percentile 7%) -> low probability of exploitation. Tags: Information Disclosure, Image CPE: cpe:2.3:a:zapad:image::webp:*:*:*:*:*:*:*:* (up to 0.2) Reported by: CPANSec References: advisory to CVE-2023-4863, oss-security list, etc. No KEV mention, so not actively exploited. No POC mentioned explicitly, but since CVE-2023-4863 is an old libwebp heap buffer overflow, POCs likely exist. However, the input doesn't confirm POC availability directly for this bundled case. I'll assume POC exists for the underlying libwebp vulnerability, but for this specific CVE, public exploit may not be explicitly stated. Use careful phrasing: "publicly available exploit code exists" if we infer from the known exploit for CVE-2023-4863? The instruction: "Use POC=YES but no KEV" if POC exists. But POC isn't mentioned. However, CVE-2023-4863 is widely known, had POCs, so it's reasonable to say that exploit code exists for the underlying libwebp vulnerability, and thus for this bundled case. The description says "bundled copy of libwebp 0.3.0 has multiple known vulnerabilities, including CVE-2023-4863." That is a specific vulnerability (heap buffer overflow in WebP) with known exploits. So it's safe to say publicly available exploit code exists.
Use of an unmaintained third-party component in the Perl module Image::EPEG (through version 0.15) exposes users to any latent flaws in the bundled Epeg 0.9.0 JPEG thumbnailing library, which was last updated in 2004 and is no longer supported. Reported by CPANSec (CWE-1104), the core issue is that any JPEG-decoding vulnerability in this two-decade-old embedded library will never receive an upstream fix. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.17%), and the assigned CVSS of 9.8 appears to reflect worst-case memory-corruption potential in image parsing rather than a specific demonstrated flaw.
The TIFF decoder does not place a limit on the size of compressed tile data. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
A maliciously-crafted image can cause excessive CPU consumption in decoding. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An issue was discovered in the image crate before 0.23.12 for Rust. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.