MEDIUMCVSS 5.3EPSS 0.4%

CVE-2026-24807

Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec

Published: 2026-01-27
Modified: 2026-11-03
EPSS percentile: 32%
Aliases: GHSA-23f4-hfmq-94mj
Sources: github-advisory

Summary

Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java. This issue affects all versions of quick-media. A patch is available: [3970e96](https://github.com/liuyueyi/quick-media/pull/123/commits/3970e967f6661328a5544fd0b977dac1a35e380b)

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	com.github.liuyueyi.media:batik-codec-fix	—	—

Remediation: No patched version is listed by GitHub.

References

https://github.com/advisories/GHSA-23f4-hfmq-94mj

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.