SUPERAntiSpyware
CVE-2025-14488
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local code execution
-
DeliveryInteract with SAS Core Service exposed function
-
ExploitInvoke dangerous method to run payload
-
ExecutionExecute arbitrary code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Exploitation requires the attacker to already possess the ability to run low-privileged code on a host where RealDefense SUPERAntiSpyware (Professional) is installed and the SAS Core Service is running - the service exposes a dangerous function reachable by a local, low-privileged user. Limiting factors: no remote network vector (AV:L), the product must be installed and its Core Service active, and the attacker needs a pre-existing local foothold; there is no user-interaction requirement (UI:N) and attack complexity is low (AC:L), so once local access is held, escalation to SYSTEM is straightforward. |
| Impact | This is a credible but context-limited local privilege escalation. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: the attacker needs local access and already-held low-privilege code execution (PR:L), no user interaction, and low complexity, yielding full SYSTEM compromise (C/I/A all High). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is a quality/maturity finding from Trend Micro ZDI (ZDI-CAN-27657 / ZDI-25-1167), not evidence of in-the-wild use. The 'RCE' tag could mislead triage: this is NOT remotely exploitable - code execution is a local post-exploitation outcome, not a network entry point, and the CVSS vector confirms AV:L. Net: a genuine high-severity local EoP worth patching on affected hosts, but not an internet-facing emergency; realistic priority is driven by how many systems run the product and already allow untrusted local code, not by remote mass-exploitation potential. |
| Exploit ScenarioDerived | An attacker who has already achieved low-privileged code execution on a Windows host (e.g., via phishing or a standard-user foothold) invokes the exposed dangerous function in the SAS Core Service to run arbitrary code as SYSTEM, achieving full local takeover. No proof-of-concept is public per the available data, and exploitation requires AC:L/PR:L - low complexity but prior local access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a user who already holds low-privileged code execution on the host to invoke a dangerous function exposed by the SAS Core Service and run arbitrary code in the SYSTEM context. The flaw is local-only (AV:L), requires low privileges (PR:L), needs no user interaction (UI:N), and has low attack complexity, giving a base score of 7.8; a standalone local foothold is therefore both the prerequisite and the principal constraint on real-world impact. No public exploit code has been identified at time of analysis and the issue is not tracked as actively exploited (CISA KEV), so risk is highest on multi-user endpoints, VDI/RDP hosts, and systems where unprivileged users routinely run code alongside an active SAS Core Service.
RemediationAI
No vendor-released patch or fixed version has been identified in the available data, so remediation centers on tracking the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-25-1167/ for the vendor's patched build and applying it as soon as RealDefense publishes one, then verifying the SAS Core Service version after upgrade. Until a fix is available, the most effective control is to remove the prerequisite: enforce least privilege and application allowlisting (WDAC/AppLocker) so non-administrative users cannot execute arbitrary binaries or scripts that reach the service interface, which is why multi-user RDP, VDI, and shared-workstation deployments carry the most exposure. Where the anti-malware endpoint protection can be traded off temporarily, stopping or disabling the SAS Core Service removes the exposed attack surface, but this disables real-time protection and should be paired with a compensating endpoint control. Restrict interactive logon and remote desktop access to trusted administrative accounts, and monitor for SYSTEM-level child processes spawned by the SAS Core Service (unexpected command shells, script interpreters, or LOLBins) as a high-fidelity detection for exploitation attempts. If real-time scanning must remain enabled, isolate high-risk user populations to hosts where the product is not installed or is replaced with an alternative endpoint protection platform.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-749, Exposed Dangerous Method or Function, a design and implementation weakness in which a privileged component publishes an operation that a lower-privileged caller can reach without adequate restriction. In SUPERAntiSpyware Professional, that component is the SAS Core Service, which runs with high privileges to provide real-time anti-malware enforcement and therefore exposes an inter-process communication surface (service control, RPC/COM endpoint, or named-pipe-style interface) to local processes. Because the exposed function does not sufficiently validate or impersonate the calling process's privilege level, a low-privileged local user can direct the service to perform a protected operation on its behalf, yielding code execution as SYSTEM. The CPE string cpe:2.3:a:superantispyware:superantispyware:*:*:*:*:professional:*:*:* indicates the Professional edition is the affected product line with no version constraints published, so all shipped builds should be presumed in scope until the vendor enumerates fixed releases. The authoritative assessment confirms a local, low-complexity attack path that requires prior code execution on a host where the product is installed and the Core Service is running; there is no remote network vector. ZDI assigned the case ZDI-CAN-27657 and published it as ZDI-25-1167.
Know when Superantispyware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector and prior low-privilege code execution give AV:L/PR:L; the exposed function is trivially reachable (AC:L) and yields SYSTEM, so C/I/A all High.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27657.
Executive ViewAI
CVE-2025-14488 affects RealDefense SUPERAntiSpyware Professional and allows a low-privileged local user to escalate to SYSTEM, which can turn an existing foothold on an endpoint into full administrative control. The risk is concentrated on multi-user endpoints, VDI/RDP hosts, and systems where unprivileged users routinely run code alongside the SAS Core Service. Leadership should care because exploitation requires prior local access and no public exploit has been identified at time of analysis, but the absence of a vendor patch means affected endpoints remain exposed until compensating controls are enforced.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting local code execution to trusted users, enforcing least privilege and removing unnecessary local admin rights, disabling or removing the SAS Core Service where SUPERAntiSpyware Professional is not required, monitoring for suspicious service invocation, and isolating high-risk multi-user, VDI, or RDP hosts until a vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Superantispyware
View allIn SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYS
SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivilege
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Pri
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a low-privileged local attacker to escala
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker with existing low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already has low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already holds low-privilege
GitHub PoC
Exploit-DB