---
id: CVE-2026-24807
aliases:
  - GHSA-23f4-hfmq-94mj
title: Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec
summary: Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec
severity: medium
cwe:
  - CWE-347
vendor: github
product: 'com.github.liuyueyi.media:batik-codec-fix'
ecosystem: maven
affected:
  - 'com.github.liuyueyi.media:batik-codec-fix <= 3.0.0'
published: '2026-01-27'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T15:54:54Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-23f4-hfmq-94mj'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-24807'
  - url: 'https://github.com/liuyueyi/quick-media/pull/123'
  - url: >-
      https://github.com/liuyueyi/quick-media/commit/3970e967f6661328a5544fd0b977dac1a35e380b
  - url: 'https://github.com/liuyueyi/quick-media/pull/123#issuecomment-4305589308'
  - url: 'https://github.com/css4j/echosvg/discussions/137'
  - url: 'https://github.com/advisories/GHSA-23f4-hfmq-94mj'
tags:
  - ghsa
  - maven
epss: 0.00378
epssPercentile: 0.31945
ingestedAt: '2026-11-03T16:49:26.422Z'
---

## Overview

Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.

This issue affects all versions of quick-media. A patch is available: [3970e96](https://github.com/liuyueyi/quick-media/pull/123/commits/3970e967f6661328a5544fd0b977dac1a35e380b)

## Affected packages

- `com.github.liuyueyi.media:batik-codec-fix <= 3.0.0`

## Remediation

Refer to the advisory for the patched release.