A critical vulnerability in the ZAPAD Image::WebP module for Perl exposes systems to remote code execution due to the use of an outdated, vulnerable third-party component.

The software suffers from a dependency on a vulnerable third-party component, specifically an outdated version of libwebp. This allows an unauthenticated remote attacker to trigger heap corruption through malicious image processing.

The CVSS score of 9.8 reflects the critical nature of this flaw, as it allows for unauthenticated remote code execution with minimal complexity. Successful exploitation could lead to full system compromise, unauthorized access to sensitive data, and significant operational downtime. Because the vulnerable component is bundled directly within the module, standard system library updates will not remediate this risk.

Immediate Action: Upgrade the ZAPAD Image::WebP module to version 0.3.0 or later to ensure the bundled libwebp dependency is updated.

Proactive Monitoring: Monitor server application logs for abnormal memory usage or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Implement input validation or use a Web Application Firewall (WAF) to inspect incoming image files for malicious patterns, although these are temporary measures and not a replacement for patching.

Public Exploit Available: Yes, a public proof-of-concept exists via GitHub.

Given the critical severity and the ease of exploitation, immediate action is required to update the Image::WebP module. Organizations should verify their Perl environment dependencies and prioritize the transition to version 0.3.0 or newer to eliminate this high-risk attack vector.