{"id":"CVE-2026-24806","aliases":["EUVD-2026-4758","GHSA-8623-9fwr-4cxv"],"status":"published","title":"Buffer Write Security Vulnerability in liuyueyi/quick-media","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.\n\nThis issue affects quick-media: before v1.0.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00476,"percentile":0.41623,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2026-01-27T08:42:04Z","modified":"2026-10-28T11:10:11Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.github.liuyueyi.media:batik-codec-fix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.github.liuyueyi.media:batik-codec-fix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.0"}]}],"versions":["2.5","2.5.1","2.6.0","2.6.1","2.6.3","3.0.0"]}],"products":[{"vendor":"liuyueyi","product":"quick-media"}],"references":[{"url":"https://github.com/liuyueyi/quick-media/pull/122","tags":["patch","fix","web"]},{"url":"https://github.com/liuyueyi/quick-media/pull/122#issuecomment-4305453193","tags":["fix"]},{"url":"https://github.com/css4j/echosvg/discussions/137","tags":["web"]},{"url":"https://github.com/github/advisory-database/pull/7437","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24806","tags":["advisory"]},{"url":"https://github.com/liuyueyi/quick-media/commit/29c078450ad2865c7ad196c658cacfab55b207ee","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8623-9fwr-4cxv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24806.json","tags":["advisory"]},{"url":"https://github.com/liuyueyi/quick-media","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-24806","title":"Buffer Write Security Vulnerability in liuyueyi/quick-media","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.\n\nThis issue affects quick-media: before v1.0.","status":"published","published":"2026-01-27T08:42:04.802Z","modified":"2026-05-06T17:01:25.546Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:19:50.575061Z"}],"euvd":[{"id":"EUVD-2026-4758","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.\n\nThis issue affects quick-media: before v1.0.","status":"published","published":"2026-01-27T08:42:04Z","modified":"2026-05-06T17:01:25Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium"}],"updated_at":"2026-11-02T19:05:16.191098Z"}],"ghsa":[{"id":"GHSA-8623-9fwr-4cxv","title":"Quick-Media Batik Codec FIX package has Code Injection vulnerability","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.\n\nThis issue affects all quick-media versions. A patch is available: [e52fcee](https://github.com/liuyueyi/quick-media/commit/e52fceee32775a6be8ed1e394fbe94f4f8db036a)","status":"published","published":"2026-01-27T09:30:30Z","modified":"2026-01-28T15:52:11Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:20.563096Z"}],"nvd":[{"id":"CVE-2026-24806","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.\n\nThis issue affects quick-media: before v1.0.","status":"published","published":"2026-01-27T09:15:50.743Z","modified":"2026-06-17T10:23:37.43Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"CVE-2026-24806","title":"Buffer Write Security Vulnerability in liuyueyi/quick-media","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.\n\nThis issue affects quick-media: before v1.0.","status":"published","published":"2026-01-27T08:42:04.802Z","modified":"2026-10-28T11:10:11.220231424Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-8623-9fwr-4cxv","title":"Quick-Media Batik Codec FIX package has Code Injection vulnerability","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.\n\nThis issue affects all quick-media versions. A patch is available: [e52fcee](https://github.com/liuyueyi/quick-media/commit/e52fceee32775a6be8ed1e394fbe94f4f8db036a)","status":"published","published":"2026-01-27T09:30:30Z","modified":"2026-02-03T03:07:05.393347Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:41.732368Z"}]}}