CVE-2025-54883
BaseFortify
Publication date: 2025-08-06
Last updated on: 2025-08-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| davidosipov | security-kit | 3.5.0 |
| davidosipov | vision-ui | 1.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-338 | The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the getSecureRandomInt function of Vision UI versions 1.4.0 and below (specifically in security-kit versions prior to 3.5.0). The function has a critical cryptographic weakness caused by a silent 32-bit integer overflow in its internal masking logic. This overflow happens because the function uses a 32-bit left-shift operation to create a bitmask for rejection sampling, which fails when the requested random number range is larger than 2^32. As a result, the function does not produce a uniform distribution of random numbers for large ranges, weakening the randomness quality.
How can this vulnerability impact me? :
This vulnerability can impact you by compromising the quality of random numbers generated by the getSecureRandomInt function when used with large ranges. Since the random numbers are not uniformly distributed, any cryptographic or security operations relying on this function may be weakened, potentially allowing attackers to predict or influence outcomes that depend on randomness, which can lead to security breaches or failures in cryptographic protocols.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Vision UI to version 1.5.0 or later, as this version contains the fix for the critical cryptographic weakness in the getSecureRandomInt function. Avoid using versions 1.4.0 and below to prevent exploitation of the 32-bit integer overflow issue.