External risk intelligence

Image::WebP for Perl Bundles Vulnerable libwebp Version

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-58586

The vulnerability exists in a library used to decode WebP images. WebP decoding is a common function in internet-facing web applications and services that process user-uploaded content or render images, making this code path frequently reachable from the public internet in typical deployment patterns for web-based services.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the Image::WebP module for Perl, which utilizes an outdated and vulnerable version of the libwebp library. The issue stems from a bundled copy of libwebp that is not updated when the system's libwebp is patched, meaning external updates do not address this specific vulnerability. This could potentially allow for severe impacts if untrusted WebP images are processed.

Outdated image library bundled in Perl module.
Critical vulnerability affects image processing.
Confirm if Perl Image::WebP is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user into decoding a specially crafted WebP image. Since the vulnerable library is bundled directly within the Image::WebP module, any application using this module to process WebP images would be susceptible, potentially allowing an attacker to execute arbitrary code.

Requires decoding untrusted images.
Vulnerable bundled image decoder.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in the bundled libwebp library within Image::WebP for Perl could allow an attacker to execute arbitrary code when processing untrusted WebP images. This is because the module uses an outdated and vulnerable copy of libwebp that is compiled directly into the module, bypassing system-level security updates.

Arbitrary code execution.
Processing untrusted WebP images.
Compromise of the application.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Image::WebP module for Perl includes a vulnerable bundled version of libwebp, meaning standard system updates won't fix it. Owners of applications that decode WebP images, especially those processing untrusted input, must first identify where this module is used, confirm its exposure and criticality, and then coordinate remediation.

Application owners must own the issue.
Verify untrusted WebP image decoding.
Plan targeted remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Image::WebP for Perl?

Image::WebP is a Perl software module used by developers to handle, manipulate, or decode WebP image files within their applications. It provides a bridge between Perl code and the underlying libwebp library functions. Unlike many packages that connect to a shared system library, this module statically embeds its own copy of the libwebp code directly into the application, which creates a unique dependency lifecycle separate from the operating system.

What does CVE-2026-58586 mean for security?

This CVE highlights a memory safety weakness within the outdated libwebp 0.3.0 code bundled inside the module. Because the library is bundled, it contains known vulnerabilities, including those that allow for arbitrary code execution. In plain terms, the module's decoder may fail to process malformed data safely, allowing an attacker to potentially take control of the application that performs the image processing.

How is this vulnerability triggered?

The issue is triggered only when an application uses Image::WebP to decode or process an untrusted WebP image file provided by an outside source. The vulnerability remains dormant if the application does not use this module or if it only processes trusted images from internal, secured sources. Simply having the module installed on a system does not trigger the bug; the code path must be actively invoked to decode a malicious file.

Why does Halo Surface Signal flag this as external?

Halo Surface Signal labels this as external because the vulnerability is frequently reachable from the public internet. Many web applications use image processing libraries to handle user-uploaded content or render images on public-facing sites. Since the attack vector is network-based and the vulnerable code is commonly used in these internet-facing services, applications using this module are often exposed to traffic from remote, unauthenticated users.

How do I secure my application against this?

Since this module embeds its own library, standard OS-level updates to your system's libwebp will not fix the issue. You must first audit your environment to locate where Image::WebP is actively used in your Perl codebase. Once identified, you should prioritize restricting its use on untrusted inputs and coordinate with your development team to replace or update the vulnerable module to a version that uses a secure, modern library.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.