Security Updates for Microsoft Visual Studio Products 17.14.17 (October 2025)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(270700);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/24");

  script_cve_id("CVE-2025-54132");
  script_xref(name:"IAVA", value:"2025-A-0760-S");

  script_name(english:"Security Updates for Microsoft Visual Studio Products 17.14.17 (October 2025)");

  script_set_attribute(attribute:"synopsis", value:
"The Microsoft Visual Studio Products are affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by 
multiple vulnerabilities, including:

  - Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid 
    (which is used to render diagrams) allows embedding images which then get rendered by Cursor in the chat 
    box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server 
    through an image fetch after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) 
    might also trigger this exploit at will. This issue requires prompt injection from malicious data 
    (web, image upload, source code) in order to exploit. In that case, it can send sensitive information 
    to an attacker-controlled external server. (CVE-2025-54132)

Note that Nessus has not tested for these issues but has instead relied only on the application's 
self-reported version number.");
  # https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes?tabs=allfeatures#17.14.17
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3e135294");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released the following security updates to address this issue:
    - Update 17.14.17 for Visual Studio 2022");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-54132");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_studio");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ms_bulletin_checks_possible.nasl", "microsoft_visual_studio_installed.nbin");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible", "installed_sw/Microsoft Visual Studio", "SMB/Registry/Enumerated");
  script_require_ports(139, 445, "Host/patch_management_checks");

  exit(0);
}

include('vcf_extras_visual_studio.inc');

get_kb_item_or_exit('SMB/Registry/Enumerated');

var app_info = vcf::visual_studio::get_app_info();

var constraints = [{'product': '2022', 'min_version': '17.14', 'fixed_version': '17.14.36603.0', 'fixed_display': '17.14.36603.0 (17.14.17)'}];

vcf::visual_studio::check_version_and_report(
  app_info: app_info,
  constraints: constraints,
  severity: SECURITY_HOLE
);