Live › vulnerability › CVE-2026-24807
The Batik Codec FIX Java library's PNG codec does not properly verify a cryptographic signature in its SeekableOutputStream code. The sources do not state what an attacker can do with a forged file beyond this.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:54 UTC, 0h before NVD. All times on this page are UTC.
Projects that depend on the batik-codec-fix Maven artifact at version 3.0.0 or earlier, in particular those that use it to decode or process PNG images. The sources say all versions of quick-media are affected and do not describe the exact exposure path, so the team should confirm whether PNG input from untrusted sources reaches this code. Teams that do not use this artifact can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| com.github.liuyueyi.media:batik-codec-fix | maven | <= 3.0.0 | – |
com.github.liuyueyi.media:batik-codec-fix is present and at a version <= 3.0.0 in the project's build file or dependency tree.org.apache.batik.ext.awt.image.codec.util package in the classpath.3970e96 in the liuyueyi/quick-media repository; the sources do not name a fixed release version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.
This issue affects all versions of quick-media. A patch is available: 3970e96
This page as .md · .json · in your agent: get_signal("CVE-2026-24807")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.