PT-2025-32008 · Vision Ui+1 · Vision Ui+1

Davidosipov · Published 2025-08-05 · Updated 2025-08-06 · CVE-2025-54883

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Vision UI versions 1.4.0 and below security-kit versions prior to 3.5.0

Description The getSecureRandomInt function contains a cryptographic weakness due to a silent 32-bit integer overflow in its internal masking logic. This prevents the function from producing a uniform distribution of random numbers when the requested range between min and max is larger than 2³². The root cause is the use of a 32-bit bitwise left-shift operation (<<) to generate a bitmask for the rejection sampling algorithm, resulting in an incorrect mask for ranges requiring 32 or more bits of entropy.

Recommendations Update to Vision UI version 1.5.0 or later. Update security-kit to version 3.5.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2025-54883

GHSA-C9XG-X7H3-MQ2Q

Affected Products

Vision Ui

Security-Kit

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54883.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-54883 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54883 · Security Note
• https://github.com/DavidOsipov/Vision-ui/commit/347355859f05e98047efbd96fc0e61b9191324f1 · Note
• https://twitter.com/CVEnew/status/1952880930479325640 · Twitter Post
• https://github.com/DavidOsipov/Vision-ui/security/advisories/GHSA-c9xg-x7h3-mq2q · Note
• https://twitter.com/offseq/status/1952882434501972434 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1952896767420191111 · Twitter Post