Comments on CVE-2026-24806 and CVE-2026-24807

In the Apache XML Graphics Commons tracker, an issue was reported about two security vulnerabilities, CVE-2026-24806 and CVE-2026-24807:

https://issues.apache.org/jira/browse/XGC-149

The security impact is overstated, but it is true that a couple of write implementations do not match the documented behavior. The required changes were committed to EchoSVG ten days ago.

Proposed Batik and XGC patches

The issue includes a couple of patches to Batik and XML Graphics Commons. I did not look at them but the comment mentions the following edits:

2 in PNGImageEncoder
1 in SeekableOutputStream
1 in batik-transcoder JPEGTranscoder (I placed it after the os null check which returns)

which means that one of the edits is probably correct but the others are modifying valid code. Meanwhile they are missing a file that should be patched.

Security advisories

The referenced security vulnerabilities are:

• https://nvd.nist.gov/vuln/detail/CVE-2026-24806
• https://nvd.nist.gov/vuln/detail/CVE-2026-24807

They are bogus and I reported that to Github. Quoting my comment on CVE-2026-24806:

the PNGImageEncoder.java file cannot be compiled after the patch, because it references a buffer field which is not there. Actually, that tree is not even compiled during the quick-media build so no one noticed. The patch was most likely intended to apply to a different write method

In short, the patch referenced by CVE-2026-24806 does not even compile and the described effects are overstated.

And about CVE-2026-24807:

This vulnerability references a patch which is modifying correct code. In the pre-patch code, the bounds are checked by a call to a RandomAccessFile field, which implements the DataOutput interface.

I hope that those advisories are considered invalid.

[carlosame]

I reported GovTech CSG and commented on the relevant PRs in quick-media but got no replies, so I contacted MITRE.

CVE-2026-24806

The advisory claims "Code Injection" but the code in lines 91-93 of PNGImageEncoder.java which was altered by the patch was correct and there is no such code injection:

https://github.com/liuyueyi/quick-media/blob/f600bc7960f957df4c4d53c3bb414c571f4c190d/plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png/PNGImageEncoder.java#L91-L93

What's worse, the source directory tree (svg-plugin) which supposedly contains the bug is not even compiled during the quick-media build. The mentioned software product cannot be vulnerable because that code is not even shipped!

The provided patch (liuyueyi/quick-media#122), if compiled, would result in a compilation error because it references a buffer field which is not there. So the patch is wrong.

I contacted both GovTech CSG and the "quick-media" project on April 23, no response.

This CVE indirectly affects other projects because the source file PNGImageEncoder.java was originally from Apache Batik.

CVE-2026-24807

The advisory claims "Improper Verification of Cryptographic Signature vulnerability" but the code which was altered by the patch is correct and there is no cryptographic signature verification anywhere.

What's worse, the source directory tree (svg-plugin) which supposedly contains the bug is not even compiled during the quick-media build. The mentioned software product cannot be vulnerable because that code is not even shipped!

The provided patch (liuyueyi/quick-media#123) does checks that were already being done. The behavior of the code was not changed.

Moreover the reporter of the "vulnerability" does not realize that in Java, overflows in array accesses result in exceptions (the documented behavior) and not in code execution.

I contacted both GovTech CSG and the "quick-media" project on April 23, no response.

This CVE indirectly affects other projects because the affected source file was originally from Apache Batik.

Ping @liuyueyi @simei2k

[carlosame]

Two weeks later I still have no news about this. And there are relevant questions in the air:

• How a CNA can approve two advisories that obviously hallucinate about "Code Injection" and "Improper Verification of Cryptographic Signature vulnerability" that are nowhere to be found. And both have been reviewed by Github.

• Why the maintainer of a random Chinese open source project has the final word on a supposed vulnerability on Apache Software Foundation (ASF) sources.

• How a CNA can endorse the modification of code inside org.apache.* packages, which infringes the ASF license as only code coming from ASF infrastructure, and approved through the ASF processes can be put into those packages (when I forked Xalan I was very careful about that).

• How the source artifacts for the batik-codec-fix package with dates of 2020-2022 already contain the fake "security fix", when the pull requests with the "fixes" are from May 2025, and the security advisory is from this year?