CVE-2026-24807

Buffer Overflow Vulnerability in liuyueyi/quick-media

View on CVE.org
Published Jan 27, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.

This issue affects quick-media: before v1.0.

Analysis

AI-generated

Technical impact

Improper verification of cryptographic signatures in the SVG plugin of quick‑media allows malicious actors to supply forged signed content that the application will accept as valid. This signature‑bypass flaw (CWE‑347) can undermine the integrity guarantees of the system and potentially lead to unauthorized actions such as code execution or privilege escalation.

Affected Systems

The vulnerability impacts all releases of liuyueyi quick‑media before version 1.0, specifically the modules under plugins/svg-plugin/batik‑codec‑fix/src/main/java/org/apache/batik/ext/awt/image/codec/util that reference SeekableOutputStream.Java.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves processing specially crafted SVG files or other signed data that can be supplied by an attacker, leading the application to accept and act upon forged inputs.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to quick‑media version 1.0 or newer, which contains the fixed signature verification logic.
  • If an immediate upgrade is not feasible, limit the SVG plugin to trusted content sources and enforce external signature validation to mitigate the bypass risk.
  • Disable the SVG plugin in the application's configuration until a patch that addresses the signature verification flaw is applied.

Generated by OpenCVE AI on April 18, 2026 at 02:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-23f4-hfmq-94mj Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Liuyueyi
Liuyueyi quick-media
Vendors & Products Liuyueyi
Liuyueyi quick-media
Type Values Removed Values Added
Description Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java. This issue affects quick-media: before v1.0.
Title Buffer Overflow Vulnerability in liuyueyi/quick-media
Weaknesses CWE-347
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber'}
Weaknesses
  • CWE-347

    Improper Verification of Cryptographic Signature

Sources

Status
PUBLISHED
Assigner
GovTech CSG
Published
Updated
May 6, 2026, 4:58 PM
Reserved
Jan 27, 2026, 8:39 AM

View source JSON

Updated
May 6, 2026, 4:58 PM

JSON

Status
Deferred
Published
Jan 27, 2026, 9:15 AM
Modified
Jun 17, 2026, 10:23 AM

View source JSON

No data.

Updated
Apr 18, 2026, 2:30 AM

JSON