This vulnerability (CVE-2026-24806) affects the quick-media product by liuyueyi, specifically in the plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules. It is classified as CWE-94, indicating improper control of code generation leading to code injection. The affected component is PNGImageEncoder.Java. The issue exists in versions before 1.0 of quick-media. The CVSS 4.0 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability impacts confidentiality and integrity with limited impact on availability. No patch or remediation guidance is currently available from the vendor or authoritative sources.

An attacker could exploit this vulnerability to inject code via the PNGImageEncoder.Java component, potentially leading to unauthorized code execution or manipulation of the affected application. The CVSS score indicates moderate impact on confidentiality and integrity, with no privileges required but user interaction necessary. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor vendor communications for updates. Until a patch is available, avoid processing untrusted PNG images with the affected versions of quick-media. No vendor advisory indicates that the issue is already mitigated or requires no action.