{"id":"CVE-2026-24807","kind":"vulnerability","aliases":["CVE-2026-24807","GHSA-23f4-hfmq-94mj"],"related":[],"title":"Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec","description":"Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.\n\nThis issue affects all versions of quick-media. A patch is available: [3970e96](https://github.com/liuyueyi/quick-media/pull/123/commits/3970e967f6661328a5544fd0b977dac1a35e380b)","summary":"The Batik Codec FIX Java library's PNG codec does not properly verify a cryptographic signature in its SeekableOutputStream code. The sources do not state what an attacker can do with a forged file beyond this.","severity":"medium","cvss":5.3,"epss":0.00378,"exploited":false,"exploited_at":null,"products":[{"name":"com.github.liuyueyi.media:batik-codec-fix","fixed":[],"affected":"<= 3.0.0","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["batik-codec-fix","cwe-347","java","maven","package","png"],"not_affected_if":["not-using-batik-codec-fix"],"how_to_check":"- Check whether the Maven dependency `com.github.liuyueyi.media:batik-codec-fix` is present and at a version `<= 3.0.0` in the project's build file or dependency tree.\n- Look for the `org.apache.batik.ext.awt.image.codec.util` package in the classpath.","fix":"- A patch is referenced as commit `3970e96` in the liuyueyi/quick-media repository; the sources do not name a fixed release version.","status":"open","published_at":"2026-01-27T09:15:50+00:00","first_seen_at":"2026-11-03T15:54:57+00:00","triaged_at":"2026-11-03T15:56:14+00:00","updated_at":"2026-11-03T16:21:46+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T15:56:14Z","model":"claude-haiku-5-5","output":{"fix":"- A patch is referenced as commit `3970e96` in the liuyueyi/quick-media repository; the sources do not name a fixed release version.","reach":"unknown","title":"Batik Codec FIX: PNG codec skips signature verification, accepting forged data","impact":"medium","summary":"The Batik Codec FIX Java library's PNG codec does not properly verify a cryptographic signature in its SeekableOutputStream code. The sources do not state what an attacker can do with a forged file beyond this.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","maven","batik-codec-fix","png"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; sources describe only a signature verification flaw","analyst_note":"Confirm the fixed release version and the real exploit path for PNG input at https://github.com/advisories/GHSA-23f4-hfmq-94mj and the linked commit.","how_to_check":"- Check whether the Maven dependency `com.github.liuyueyi.media:batik-codec-fix` is present and at a version `<= 3.0.0` in the project's build file or dependency tree.\n- Look for the `org.apache.batik.ext.awt.image.codec.util` package in the classpath.","plain_action":"","needs_analyst":true,"not_affected_if":["not-using-batik-codec-fix"],"who_is_affected":"Projects that depend on the batik-codec-fix Maven artifact at version 3.0.0 or earlier, in particular those that use it to decode or process PNG images. The sources say all versions of quick-media are affected and do not describe the exact exposure path, so the team should confirm whether PNG input from untrusted sources reaches this code. Teams that do not use this artifact can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000758,"input_tokens":4300,"output_tokens":655,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,22A '-24807':15A,23A '-347':34B '/liuyueyi/quick-media/pull/123/commits/3970e967f6661328a5544fd0b977dac1a35e380b)':111C '23f4':18A '3970e96':108C '94mj':20A 'affect':97C 'associ':90C 'attack':66B 'avail':107C 'batik':4A,26A,30B,40B 'batik-codec-fix':25A,29B 'beyond':73B 'code':58B 'codec':5A,12A,27A,31B,41B,47B 'com.github.liuyueyi.media':24A 'cryptograph':53B,77C 'cve':13A,21A 'cwe':33B 'file':72B,93C 'fix':6A,28A,32B,42B 'forg':71B 'ghsa':17A 'ghsa-23f4-hfmq-94mj':16A 'github.com':110C 'github.com/liuyueyi/quick-media/pull/123/commits/3970e967f6661328a5544fd0b977dac1a35e380b)':109C 'hfmq':19A 'improp':74C 'issu':96C 'java':35B,43B 'librari':44B 'liuyueyi':81C 'maven':36B 'media':3A,84C,103C 'modul':86C 'packag':7A,37B 'patch':105C 'plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util':85C 'png':11A,38B,46B 'program':92C 'proper':50B 'quick':2A,83C,102C 'quick-media':1A,82C,101C 'seekableoutputstream':57B 'seekableoutputstream.java':94C 'signatur':54B,78C 'sourc':60B 'state':63B 'verif':75C 'verifi':51B 'version':99C 'vulner':9A,79C,88C","nicknames":[],"mitigations":[],"who_affected":"Projects that depend on the batik-codec-fix Maven artifact at version 3.0.0 or earlier, in particular those that use it to decode or process PNG images. The sources say all versions of quick-media are affected and do not describe the exact exposure path, so the team should confirm whether PNG input from untrusted sources reaches this code. Teams that do not use this artifact can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["comgithubliuyueyimediabatikcodecfix"],"ptokens":["batik","codec","com","fix","github","liuyueyi","media"],"labels":["batikcodecfix","cwe347","java","maven","medium","package","png"],"first_public_at":"2026-01-27T09:15:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","cvss_by":"cve_disclosure@tech.gov.sg","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-23f4-hfmq-94mj","url":"https://github.com/advisories/GHSA-23f4-hfmq-94mj","severity":"medium","published_at":"2026-01-27T09:30:30+00:00","modified_at":"2026-11-03T15:54:54+00:00","first_seen_at":"2026-11-03T15:54:57+00:00","fetched_at":"2026-11-03T16:15:20+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-24807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24807","severity":null,"published_at":"2026-01-27T09:15:50+00:00","modified_at":"2026-06-17T10:23:37+00:00","first_seen_at":"2026-11-03T16:21:46+00:00","fetched_at":"2026-11-03T16:21:46+00:00","note":null}],"documents":[{"id":58602,"url":"https://github.com/liuyueyi/quick-media/pull/123","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58603,"url":"https://github.com/liuyueyi/quick-media/commit/3970e967f6661328a5544fd0b977dac1a35e380b","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58604,"url":"https://github.com/liuyueyi/quick-media/pull/123#issuecomment-4305589308","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}