CVE-2025-63095 Details

A denial-of-service vulnerability has been identified in Tempus Ex Hello-Video-Codec version 0.1.0. The issue arises from improper input validation in the BitstreamWriter::write_bits() function, where untrusted bit-lengths derived from user-controlled input are accepted without bounds checking. This flaw can be exploited by sending a crafted media file that encodes a large length value, leading to silent data corruption in the output stream. Such corruption can disrupt downstream processes that rely on the integrity of the data, causing potential issues like corrupted archives or polluted analytics inputs.

To address this vulnerability, the 'write_bits' function should be modified to enforce strict input validation, rejecting any length values outside the range of 1 to 64 bits. Additionally, the function should be updated to use iterative logic instead of recursion, which can fragment the internal state and lead to corruption.