RealDefense SUPERAntiSpyware CVE-2025-14489
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local code execution
-
ExploitInvoke exposed dangerous function in SAS Core Service
-
ExecutionExecute arbitrary code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Exploitation requires the attacker to already have the ability to execute low-privileged code on a system where RealDefense SUPERAntiSpyware (Professional edition) is installed and its SAS Core Service is running - this is a mandatory prerequisite, not a default-remote scenario. The flaw is reached by invoking an exposed dangerous function in the SAS Core Service (CWE-749), so the limiting factor is the need for prior local access; there is no remote attack surface (AV:L) and no user interaction is required (UI:N). Realistic risk is therefore confined to hosts already partially compromised or accessible to untrusted local/standard users that have the product installed. |
| Impact | This is a genuine local privilege escalation (LPE) issue but not an emergency. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N) confirms it requires local access and already-held low-privilege code execution on the target, so it is a post-compromise escalation primitive rather than an initial-access vector - it cannot be triggered remotely or unauthenticated. The 7.8 'High' score is driven entirely by the full C:H/I:H/A:H impact of reaching SYSTEM, not by ease of reach. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, meaning there is no signal of active or probable near-term exploitation (no SSVC exploitation/automatable data was supplied either). The practical risk is that an attacker who already has a foothold on a machine running SUPERAntiSpyware Professional can elevate to SYSTEM - a classic second-stage move - but the absence of exploitation signals and the local-only vector place this below internet-facing or wormable issues in patch priority. Note the 'RCE' tag overstates the issue: the vector is AV:L, so this is local arbitrary code execution as SYSTEM, not remote code execution - treat accordingly. |
| Exploit ScenarioDerived | An attacker who has already gained a low-privileged foothold (e.g., via phishing or a standard user account) interacts with the exposed dangerous function in the SAS Core Service to execute code as SYSTEM, taking full control of the host. No public exploit code was identified in the provided data, though the vulnerability was discovered and documented by Trend Micro's Zero Day Initiative (ZDI-25-1165 / ZDI-CAN-27658). Because CVSS indicates AC:L and no user interaction, exploitation is straightforward once local code execution is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a local authenticated low-privileged attacker to invoke an exposed dangerous function in the SAS Core Service and execute arbitrary code as SYSTEM. Affected installations are Professional-edition builds with the SAS Core Service running; the assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), reflecting a mandatory prior local foothold rather than a remote attack path. No public exploit code or CISA KEV entry was identified at time of analysis.
RemediationAI
Patch status is not confirmed in the provided data; consult the ZDI advisory ZDI-25-1165 at https://www.zerodayinitiative.com/advisories/ZDI-25-1165/ for vendor guidance and apply any update RealDefense publishes. Until a fix is confirmed, restrict local logon and code-execution rights on hosts running SUPERAntiSpyware Professional so that only trusted users can reach the SAS Core Service (trade-off: reduced multi-user flexibility). If the service is not required, stop and disable SAS Core Service (trade-off: real-time protection, scanning, and update functionality may degrade). Monitor for suspicious child processes or actions originating from the SAS Core Service, and use application control to block untrusted binaries from running on sensitive endpoints, since exploitation requires a prior low-privileged foothold. Isolate high-value systems with the product installed that cannot be patched immediately.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-749 (Exposed Dangerous Function), a weakness in which a privileged service exposes a method or interface that lower-privileged local code can invoke without adequate access control. Here the exposed function resides in the SAS Core Service of SUPERAntiSpyware Professional, which runs with high privileges, so a successful call crosses a local privilege boundary and can yield SYSTEM-level code execution. The CPE cpe:2.3:a:superantispyware:superantispyware:*:*:*:*:professional:*:*:* identifies the Professional edition across versions. The local vector (AV:L) and low privileges required (PR:L) mean the attacker must already have code execution on the host; the service's exposed function then provides the escalation primitive. The provided data does not specify the exact IPC, RPC, COM, or other local interface involved, so defenders should treat any local endpoint reachable by standard users that is serviced by SAS Core Service as potentially affected.
Know when Superantispyware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires prior low-privileged local code execution (AV:L, PR:L) with no user interaction, and yields SYSTEM-level code execution giving full C/I/A impact.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27658.
Executive ViewAI
SUPERAntiSpyware Professional installations running the SAS Core Service are exposed to a local privilege-escalation flaw that lets an authenticated low-privileged user with existing local access execute code as SYSTEM, creating a path to full endpoint compromise. Leadership should care because a single compromised user session on an affected endpoint could escalate to system-level control, increasing risk to sensitive data and operations despite the requirement for prior local foothold. No public exploit code or CISA KEV entry was identified at time of analysis, and no vendor-released patch was identified.
Restrict local logon and administrative rights to trusted users, enforce least privilege and application control, monitor SAS Core Service invocation and SYSTEM-level process creation, isolate high-risk endpoints, and remove or disable the service or product where operationally feasible; engage the vendor for mitigation guidance until a patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Superantispyware
View allIn SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYS
SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivilege
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Pri
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a low-privileged local attacker to escala
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker with existing low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already has low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already holds low-privilege
GitHub PoC
Exploit-DB