5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24806

CVE-2026-24806: Quick-Media Batik Codec FIX package has Code Injection vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.

This issue affects all quick-media versions. A patch is available: e52fcee

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24806

CVE-2026-24806:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.github.liuyueyi.media:batik-codec-fix	maven	<= 3.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is described as a 'Code Injection' but the patch reveals a buffer overflow vulnerability in the write method of the PNGImageEncoder class. The commit history shows that the write(byte[] b, int off, int len) method was modified to include input validation. The original code, dos.write(b, off, len);, did not perform any checks on the off and len parameters. This could lead to an ArrayIndexOutOfBoundsException or, in a worst-case scenario, allow an attacker to write arbitrary data to the output stream, potentially leading to code execution. The patch mitigates this by adding checks to ensure that the offset and length are not negative and that their sum does not exceed the length of the input byte array. This prevents any out-of-bounds write operations.

Vulnerable functions

org.apache.batik.ext.awt.image.codec.png.PNGImageEncoder.write

plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png/PNGImageEncoder.java

The `write` method in `PNGImageEncoder.java` is vulnerable to a buffer overflow. The original code did not validate the `off` and `len` parameters before writing to the output stream. This could allow an attacker to provide a malicious offset and length, causing a write outside of the intended buffer. The patch adds validation to ensure that `off` and `len` are within the bounds of the byte array `b`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.