{"id":"CVE-2026-24807","aliases":["EUVD-2026-4759","GHSA-23f4-hfmq-94mj"],"status":"published","title":"Buffer Overflow Vulnerability in liuyueyi/quick-media","description":"Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.\n\nThis issue affects quick-media: before v1.0.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00378,"percentile":0.32082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-347"],"published":"2026-01-27T08:43:51Z","modified":"2026-11-03T16:00:03Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.github.liuyueyi.media:batik-codec-fix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.github.liuyueyi.media:batik-codec-fix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.0"}]}],"versions":["2.5","2.5.1","2.6.0","2.6.1","2.6.3","3.0.0"]}],"products":[{"vendor":"liuyueyi","product":"quick-media"}],"references":[{"url":"https://github.com/liuyueyi/quick-media/pull/123","tags":["patch","fix","web"]},{"url":"https://github.com/liuyueyi/quick-media/pull/123#issuecomment-4305589308","tags":["fix","web"]},{"url":"https://github.com/css4j/echosvg/discussions/137","tags":["web"]},{"url":"https://github.com/github/advisory-database/pull/7438","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24807","tags":["advisory"]},{"url":"https://github.com/liuyueyi/quick-media/commit/3970e967f6661328a5544fd0b977dac1a35e380b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-23f4-hfmq-94mj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24807.json","tags":["advisory"]},{"url":"https://github.com/liuyueyi/quick-media","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-24807","title":"Buffer Overflow Vulnerability in liuyueyi/quick-media","description":"Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.\n\nThis issue affects quick-media: before v1.0.","status":"published","published":"2026-01-27T08:43:51.077Z","modified":"2026-05-06T16:58:44.74Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:19:50.575061Z"}],"euvd":[{"id":"EUVD-2026-4759","description":"Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.\n\nThis issue affects quick-media: before v1.0.","status":"published","published":"2026-01-27T08:43:51Z","modified":"2026-05-06T16:58:44Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium"}],"updated_at":"2026-11-02T19:05:16.191098Z"}],"ghsa":[{"id":"GHSA-23f4-hfmq-94mj","title":"Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec","description":"Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.\n\nThis issue affects all versions of quick-media. A patch is available: [3970e96](https://github.com/liuyueyi/quick-media/pull/123/commits/3970e967f6661328a5544fd0b977dac1a35e380b)","status":"published","published":"2026-01-27T09:30:30Z","modified":"2026-11-03T15:54:54Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-03T15:57:21.522884Z"}],"nvd":[{"id":"CVE-2026-24807","description":"Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.\n\nThis issue affects quick-media: before v1.0.","status":"published","published":"2026-01-27T09:15:50.89Z","modified":"2026-06-17T10:23:37.543Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"CVE-2026-24807","title":"Buffer Overflow Vulnerability in liuyueyi/quick-media","description":"Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.\n\nThis issue affects quick-media: before v1.0.","status":"published","published":"2026-01-27T08:43:51.077Z","modified":"2026-10-28T10:59:12.413460804Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"GHSA-23f4-hfmq-94mj","title":"Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec","description":"Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.\n\nThis issue affects all versions of quick-media. A patch is available: [3970e96](https://github.com/liuyueyi/quick-media/pull/123/commits/3970e967f6661328a5544fd0b977dac1a35e380b)","status":"published","published":"2026-01-27T09:30:30Z","modified":"2026-11-03T16:00:03.545656107Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-03T16:28:13.283511Z"}]}}