CVE-2026-58586

Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decode...

CVE-2026-58586

Image::WebP ( Perl, up to version 0.2 ) bundles libwebp 0.3.0, not the system libwebp. The bundled decoder is used when decoding untrusted WebP images, and upgrading the system libwebp does not remediate this. The bundled libwebp 0.3.0 contains multiple known vulnerabilities, including CVE-2023-4...