---
id: "CVE-2026-24807"
kind: "vulnerability"
aliases: ["CVE-2026-24807", "GHSA-23f4-hfmq-94mj"]
title: "Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec"
severity: "medium"
cvss: 5.3
epss: 0.00378
exploited: false
status: "open"
category: "package"
products: [{"name": "com.github.liuyueyi.media:batik-codec-fix", "fixed": [], "affected": "<= 3.0.0", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["batik-codec-fix", "cwe-347", "java", "maven", "package", "png"]
not_affected_if: ["not-using-batik-codec-fix"]
published_at: "2026-01-27T09:15:50+00:00"
first_seen_at: "2026-11-03T15:54:57+00:00"
updated_at: "2026-11-03T16:21:46+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-23f4-hfmq-94mj", "first_seen_at": "2026-11-03T15:54:57+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24807", "first_seen_at": "2026-11-03T16:21:46+00:00"}]
---

# Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec

The Batik Codec FIX Java library's PNG codec does not properly verify a cryptographic signature in its SeekableOutputStream code. The sources do not state what an attacker can do with a forged file beyond this.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:com.github.liuyueyi.media:batik-codec-fix affected <= 3.0.0 fixed ?

## How to check

- Check whether the Maven dependency `com.github.liuyueyi.media:batik-codec-fix` is present and at a version `<= 3.0.0` in the project's build file or dependency tree.
- Look for the `org.apache.batik.ext.awt.image.codec.util` package in the classpath.

## Fix

- A patch is referenced as commit `3970e96` in the liuyueyi/quick-media repository; the sources do not name a fixed release version.

## Timeline

- 2026-11-03T15:54:57+00:00 ghsa https://github.com/advisories/GHSA-23f4-hfmq-94mj
- 2026-11-03T16:21:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-24807

## Documents

- [fix] Patch: github.com https://github.com/liuyueyi/quick-media/pull/123
- [fix] Patch: github.com https://github.com/liuyueyi/quick-media/commit/3970e967f6661328a5544fd0b977dac1a35e380b
- [fix] Patch: github.com https://github.com/liuyueyi/quick-media/pull/123#issuecomment-4305589308

## From the sources

Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.

This issue affects all versions of quick-media. A patch is available: [3970e96](https://github.com/liuyueyi/quick-media/pull/123/commits/3970e967f6661328a5544fd0b977dac1a35e380b)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_