SUPERAntiSpyware
CVE-2025-14490
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged code execution on host
-
DeliveryLocate exposed SAS Core Service function
-
ExploitInvoke exposed dangerous function
-
ExecutionExecute arbitrary code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Exploitation requires the attacker to already have local, interactive low-privileged code execution on a Windows system with RealDefense SUPERAntiSpyware (Professional edition) installed and the SAS Core Service running. The specific prerequisite is access to the exposed dangerous function within the SAS Core Service; no user interaction (UI:N) and no network access are involved. The principal limiting factors are the need for an existing local foothold (PR:L) and the presence of the vulnerable SUPERAntiSpyware product itself, which constrains this to endpoints where that EPP software is deployed rather than general Windows hosts. |
| Impact | This is a genuine but conditionally-exploitable local privilege escalation. The CVSS 3.0 vector (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) confirms local attack vector requiring low but non-zero privileges (PR:L), with low complexity and full confidentiality/integrity/availability impact - consistent with the description's escalation from low-privileged code to SYSTEM. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS data is expected for a freshly-disclosed ZDI advisory and should not be read as evidence of low risk, but equally this is not a mass-exploitable remote flaw. Net: a real, high-severity local EPP issue meaningful for defense-in-depth and endpoints where SUPERAntiSpyware is deployed, but not an internet-facing emergency - prioritize behind any remotely-exploitable or KEV-listed items. No signals directly conflict; the main gap is missing exploitation-probability data (EPSS) and no confirmed patch version in the provided references. |
| Exploit ScenarioDerived | A local attacker who already has the ability to run low-privileged code on a Windows host running SUPERAntiSpyware Professional (for example, via a phishing foothold or a standard user account) interacts with the SAS Core Service's exposed dangerous function. By leveraging that exposed functionality, the attacker executes arbitrary code in the SYSTEM context, gaining full control of the endpoint. No public exploit is identified at the time of analysis, and low attack complexity (AC:L) means a working primitive would be reliable once developed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privileged local code execution to abuse an exposed dangerous function in the SAS Core Service and execute code as SYSTEM (CVSS 7.8). Exploitation requires local interactive access to a Windows endpoint where the product is installed and the SAS Core Service is running, so exposure is limited to hosts with this endpoint protection product deployed; no public exploit was identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis. Check RealDefense and the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-25-1166/) for an updated SUPERAntiSpyware Professional build and upgrade immediately when a fixed version is published. Until then, reduce exposure by removing the product from endpoints that do not require it or by stopping/disabling the SAS Core Service where operationally acceptable, with the trade-off of losing anti-malware protection and related service functionality. Because exploitation requires an existing low-privileged local foothold, enforce least privilege and restrict interactive local logon to trusted users, and monitor for unexpected SYSTEM-level process creation or anomalous SAS Core Service interactions. If the service must remain running, isolate high-value endpoints and use application control to limit execution of untrusted local code; verify the vendor advisory for the exact fixed version, as none is provided in the available data.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an exposed dangerous function (CWE-749) in the SAS Core Service, a privileged Windows service component of RealDefense SUPERAntiSpyware Professional. CWE-749 describes software that exposes a function or method which should not be accessible to lower-privileged actors, allowing those actors to misuse the service's authority. The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms a local, low-complexity attack that requires an existing low-privileged foothold, no user interaction, and no network access, with high confidentiality, integrity, and availability impact. The CPE identifier uses a wildcard version for the Professional edition, and the disclosure is tracked as ZDI-CAN-27659 / ZDI-25-1166.
Know when Superantispyware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attacker needs existing low-privileged execution (AV:L, PR:L); exposed function is directly invokable with low complexity (AC:L), yielding SYSTEM code execution with full C/I/A impact.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27659.
Executive ViewAI
RealDefense SUPERAntiSpyware Professional contains a high-severity local privilege-escalation flaw that could allow an attacker with an existing foothold on a Windows endpoint to gain SYSTEM-level control. Exposure is limited to endpoints running the product and its SAS Core Service, and exploitation requires local interactive access plus prior low-privileged code execution, so leadership should prioritize inventory and containment because no vendor patch is available.
No vendor-released patch identified at time of analysis. Interim mitigations: inventory and minimize hosts running RealDefense SUPERAntiSpyware Professional; restrict local interactive access and enforce least privilege; monitor SAS Core Service for anomalous behavior; consider temporary removal or replacement on high-risk endpoints; apply vendor guidance when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Superantispyware
View allIn SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYS
SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivilege
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Pri
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a low-privileged local attacker to escala
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker with existing low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already has low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already holds low-privilege
GitHub PoC
Exploit-DB