SUPERAntiSpyware
CVE-2025-14491
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged code execution on host
-
DeliveryLocate exposed SAS Core Service function
-
ExploitInvoke dangerous function with crafted input
-
ExecutionExecute arbitrary code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Exploitation requires that SUPERAntiSpyware (Professional edition per the CPE) be installed with its SAS Core Service running, and that the attacker already possess the ability to execute low-privileged code on the target host - the CVSS vector confirms PR:L and AV:L, so a local authenticated/standard-user foothold is a hard prerequisite. There is no remote attack surface and no user interaction is needed (UI:N) once the foothold exists. The limiting factors defenders can rely on: the flaw is not network-reachable, cannot be triggered without an existing local account/process, and is confined to systems actually running the vulnerable SAS Core Service; the specific feature or IPC entry point exposing the dangerous function is not detailed in the available advisory. |
| Impact | This is a genuine but bounded risk. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local attacker who already holds low-privileged code execution and escalates to SYSTEM via an exposed dangerous function (CWE-749) in the SAS Core Service - it is NOT remotely reachable. No EPSS score, KEV listing, or POC was provided in the input; per precision rules this is treated as 'no public exploit identified at time of analysis,' and absence of EPSS/KEV data means widespread automated exploitation cannot be inferred. No SSVC decision data was supplied. The real priority is therefore moderate: the impact (full SYSTEM compromise) is severe, but exploitation is gated behind prior local foothold, making this a post-compromise escalation primitive rather than an initial-access or wormable threat. One cross-source note: the input Tags include 'RCE' (remote code execution), which conflicts with the CVSS AV:L (local) vector and the description's explicit 'local attackers' / 'low-privileged code on the target system' language - the achievable code execution is local privilege escalation, not remote, and this discrepancy should be reconciled before triage. |
| Exploit ScenarioDerived | An attacker who has already gained low-privileged execution on a Windows endpoint running SUPERAntiSpyware Professional (e.g., via phishing or a standard user account) invokes the exposed dangerous function in the SAS Core Service to run code in the SYSTEM context. Given AV:L/AC:L/PR:L, the escalation is low-complexity and requires no further user interaction once the foothold exists. No public exploit code was identified in the provided data, though a Zero Day Initiative advisory (ZDI-25-1164, ZDI-CAN-27660) documents the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a standard user who already holds a low-privileged foothold on the host to execute arbitrary code as SYSTEM by abusing an exposed dangerous function in the SAS Core Service (CWE-749, ZDI-CAN-27660). The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N, 7.8) confirms the attack is local-only, requires an existing local account or process, and needs no user interaction once that prerequisite is met; there is no remote attack surface. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so the flaw should be treated as a post-compromise escalation primitive rather than a self-contained intrusion vector.
RemediationAI
No vendor-released patch or fixed version was identified at time of analysis, so remediation must begin with contacting RealDefense for a corrected SUPERAntiSpyware Professional build and tracking ZDI-25-1164 (https://www.zerodayinitiative.com/advisories/ZDI-25-1164/) for the vendor's fix announcement; apply the patched build as soon as it ships and verify the SAS Core Service version after upgrading. Because exploitation requires a pre-existing local foothold, the most effective near-term control is to deny that foothold: enforce least privilege so no standard user can launch arbitrary executables, apply application control/allow-listing to endpoint processes, and aggressively detect credential theft, unusual child processes spawning from the SAS Core Service, and SYSTEM-level tokens obtained by non-admin processes. Where the service is not operationally required - for example on non-Windows-server workloads or golden images where the product is licensed but unused - stopping and disabling the SAS Core Service removes the attack surface entirely, at the cost of losing real-time protection, scheduled scanning and auto-update functionality on that host. Hardening the service's ACLs or restricting which local groups may interact with the SAS Core Service endpoint reduces the caller pool, but this is a partial mitigation only, since the underlying missing caller validation remains and may be re-exposed by product updates that reset permissions. For high-value or multi-user hosts (RDP/VDI/terminal servers), restrict interactive logon to trusted administrators and segment standard-user sessions from the protected endpoint, trading some operational flexibility for a materially smaller escalation pool. Monitor for anomalous privilege transitions on hosts running SUPERAntiSpyware, since successful exploitation yields SYSTEM-level arbitrary code execution and is likely to be followed by credential dumping or defense evasion.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-749 (Exposed Dangerous Method or Function) describes software that exposes a privileged internal routine through an interface that is reachable by less-privileged callers, and the CPE entry (cpe:2.3:a:superantispyware:superantispyware:*:*:*:*:professional:*:*:*) shows the flaw is present in the Professional edition across version ranges not yet enumerated. SUPERAntiSpyware's SAS Core Service is the high-integrity component that brokers scanning, quarantine and update operations for the desktop client, so it inevitably runs with SYSTEM privileges and exposes an IPC surface (service control, named pipes or equivalent local messaging) to unprivileged client processes. Because the exposed function performs privileged work without adequately validating the identity or privileges of the caller - and without hardening the handle/ACL boundary between the low-privileged client and the SYSTEM service - any process running in the user's context can direct the service to act on its behalf. This is a classic local privilege escalation pattern for antivirus/anti-malware agents: the protective value of the product's privileged service becomes the attack surface, and the exploitability is rated AC:L because no memory corruption, race or grooming is implied. The advisory (ZDI-25-1164) does not disclose the specific function or IPC entry point, which limits signature-based detection, but the practical precondition remains a local account on a host where the vulnerable SAS Core Service is installed and running.
Know when Superantispyware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector and low-privileged foothold required (AV:L/PR:L), exposed function is trivially invokable (AC:L/UI:N), and SYSTEM-level code execution yields full C/I/A impact.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27660.
Executive ViewAI
RealDefense SUPERAntiSpyware Professional contains an unpatched local privilege-escalation flaw (CVE-2025-14491) in its SAS Core Service that lets any user with an existing low-privileged foothold on a host escalate to SYSTEM. Because the vulnerable component is a security agent itself, an attacker who lands even a minor user-level compromise on an affected endpoint can gain full machine control, undermining the trust we place in that tooling and widening the blast radius of otherwise contained incidents. Leadership should care because remediation depends on vendor action we do not yet control, and the exposure is concentrated on endpoints we intentionally deployed for protection.
No vendor patch is currently available. Interim mitigations: enforce least privilege by removing unnecessary local administrator rights and restricting interactive logon on hosts running SUPERAntiSpyware Professional; apply application allowlisting and EDR behavioral detections for service abuse and unexpected SYSTEM-level child processes spawned by SAS Core Service; reduce the attack surface by limiting which accounts can log on locally to affected endpoints; isolate or decommission the product on high-value assets where an equivalent security control exists; segment and monitor those hosts closely for post-compromise escalation activity until RealDefense publishes a fixed version.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Superantispyware
View allIn SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYS
SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivilege
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Pri
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a low-privileged local attacker to escala
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker with existing low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already has low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already holds low-privilege
GitHub PoC
Exploit-DB