The ZAPAD Image::WebP module includes a bundled copy of libwebp 0.3.0, which is a 2013 library that contains multiple known vulnerabilities, including CVE-2023-4863. Because the module does not link to a system‑installed libwebp, upgrading the system libraries does not mitigate the risk. Any component that decodes an untrusted WebP image is forced to use the vulnerable bundled decoder. This creates an opportunity for an attacker to execute arbitrary code during the decoding process. The impact manifests as a complete compromise of the process hosting the application, potentially allowing data exfiltration, privilege escalation, or further lateral movement.

Any installation of the ZAPAD Image::WebP module version 0.2 or earlier, including systems that depend on this module for image handling in Perl applications, is affected. All environments that load the ZAPAD Image::WebP module and provide user‑supplied WebP images are at risk. No specific versioning beyond 0.2 is listed; newer releases are not mentioned as affected.

The EPSS score for the ZAPAD Image::WebP module is reported as < 1 %, indicating a low but non‑zero likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The failure to support core library upgrades and the known criticality of the underlying libwebp decoder imply that a CVSS score reflecting high severity is appropriate. The lack of public exploitation data leaves the actual attack vector uncertain, but it is inferred that an attacker could provide a malicious WebP file to a vulnerable application, causing the bundled decoder to execute arbitrary code. The risk is therefore high but the probability of exploitation remains low based on current metrics.