Technical impact
The reported weakness is an improper control of code generation in the PNGImageEncoder module of the quick‑media application, which can allow an attacker to inject arbitrary code when processing crafted PNG files. The vulnerability, identified as CWE‑94, could lead to execution of attacker supplied code, compromising confidentiality, integrity, and availability of the affected system. No evidence is provided that the flaw allows a denial‑of‑service attack, but code execution would immediately raise the stakes for the application.
Affected Systems
The flaw affects the liuyueyi quick‑media application prior to version 1.0. No later releases have been listed as mitigated, and the product is identified only for the packages that contain the batik‑codec‑fix PNG modules.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1 % signals a low current likelihood of exploitation. The vulnerability is not in the CISA KEV catalogue. The likely attack vector is the processing of malicious PNG images through the plugin; an attacker would need to supply such a file to the application, which may be feasible via local file handling or, if the application exposes a remote endpoint for image uploads, remotely.
Github GHSA