VYPR
← All advisories
Medium severityOSV Advisory· Published Jan 27, 2026· Updated May 6, 2026

CVE-2026-24807

CVE-2026-24807

Description

Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.

This issue affects quick-media: before v1.0.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.github.liuyueyi.media:batik-codec-fixMaven
<= 3.0.0—

Affected products

1

Patches

1
3970e967f666

Fix Buffer Overflow Vulnerability in PNG Codec

https://github.com/liuyueyi/quick-mediaLim Sim YeeMay 11, 2025via ghsa
commit
1 file changed · +9 −1
  • plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util/SeekableOutputStream.java+9 −1 modified
    @@ -59,9 +59,17 @@ public void write(byte[] b) throws IOException {
     }
 
     public void write(byte[] b, int off, int len) throws IOException {
-        file.write(b, off, len);
+    if (b == null) {
+      throw new NullPointerException();
     }
 
+    if (off < 0 || len < 0 || len > b.length || off > b.length - len) {
+      throw new ArrayIndexOutOfBoundsException();
+    }
+
+    file.write(b, off, len);
+}
+
     /**
      * Invokes <code>getFD().sync()</code> on the underlying
      * <code>RandomAccessFile</code>.

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.