CVE-2025-54883 - CVE House
Back to Database
Status published Critical CVE-2025-54883

Vision UI's security-kit Contains Cryptographic Weakness

Vulnerability Description

Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the getSecureRandomInt function in security-kit versions prior to 3.5.0 (packaged in Vision-ui <= 1.4.0) contains a critical cryptographic weakness. Due to a silent 32-bit integer overflow in its internal masking logic, the function fails to produce a uniform distribution of random numbers when the requested range between min and max is larger than 2³². The root cause is the use of a 32-bit bitwise left-shift operation (<<) to generate a bitmask for the rejection sampling algorithm. This causes the mask to be incorrect for any range requiring 32 or more bits of entropy. This issue is fixed in version 1.5.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54883

Credits & Attribution

No credits recorded in the NVD database.

References

More from DavidOsipov

View All →
CVE-2025-54884
Vision UI security-kit.js: Potential Uncontrolled Resource Allocation Vulnerability
High 8.7
CVE-2025-29780
Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations
Medium 5.8
CVE-2025-29779
Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`
Medium 5.4

Affected Vendor

DavidOsipov

View all reports →

Affected Software

Vision-ui
Vulnerable Versions:
< 1.5.0

Timeline

Official Publish: August 5th, 2025
Last Modified: August 6th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-338

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.