SUPERAntiSpyware Professional
CVE-2025-14492
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local code execution
-
ExploitLocate exposed SAS Core Service function
-
ExecutionInvoke dangerous function to run payload
-
ImpactExecute arbitrary code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Requires that SUPERAntiSpyware Professional be installed and its SAS Core Service running on the target Windows host (default behavior for the product). The attacker must FIRST have the ability to execute low-privileged code locally on that machine (PR:L, AV:L) - this is the primary limiting factor and rules out remote-only attackers. No user interaction is needed (UI:N) and no special non-default configuration is called out in the advisory; the exposed dangerous function in the core service is the exploitation surface. The flaw is not reachable over the network and cannot be triggered without an existing local foothold. |
| Impact | This is a credible, moderate-to-high operational risk but NOT a top-tier emergency. The CVSS 3.0 vector (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: AV:L and PR:L confirm the attacker must already have local, low-privileged code execution, which the description explicitly states ('must first obtain the ability to execute low-privileged code'). The payoff is full SYSTEM compromise (C:H/I:H/A:H), so technical impact is total on the affected host. However, this is a second-stage/post-foothold flaw, not an initial-access vector. Key exploitation signals are MISSING: no EPSS score was provided, so exploitation probability cannot be quantified; the CVE is NOT in CISA KEV (no evidence of active exploitation); and no public POC is referenced (the only reference is the ZDI advisory). No SSVC decision data was supplied. The 'RCE' tag is misleading - the CVSS vector is AV:L (local), so this is local privilege escalation to code execution as SYSTEM, not remote code execution; treat the RCE label with caution. Net: prioritize patching on systems where untrusted or lower-trust local users operate, but this does not warrant the emergency response of a remote unauthenticated flaw. |
| Exploit ScenarioDerived | An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a standard user account) interacts with the exposed dangerous function in the SAS Core Service to execute arbitrary code as SYSTEM, achieving full host takeover. No user interaction is required (UI:N) and attack complexity is low (AC:L). No public exploit is referenced, though the ZDI advisory (ZDI-CAN-27668) implies a working private POC was used for disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privileged code execution to abuse an exposed dangerous function in the SAS Core Service and execute arbitrary code as SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires the product to be installed with its core service running, which is default behavior. No public exploit code was identified at time of analysis.
RemediationAI
No exact vendor-released patch version is identified in the provided intelligence, so check RealDefense's SUPERAntiSpyware release notes and the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-25-1172/) for a fixed build and upgrade immediately when one is published. Until a patch is confirmed, reduce exposure by restricting local interactive logon and low-privileged code execution on hosts running SUPERAntiSpyware Professional, since the attacker must first meet the PR:L prerequisite; this lowers the likelihood of exploitation but does not remove the vulnerable service. If the SAS Core Service is not required, stop and disable it, accepting that real-time protection and other product features may break. Monitor service and IPC/RPC activity for unusual calls to the SAS Core Service and enforce least privilege for local accounts; network controls will not help because the attack vector is local.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The SAS Core Service is a Windows service running with high privileges (SYSTEM) that exposes privileged functionality to local callers. CWE-749 (Exposed Dangerous Method or Function) describes the root cause: the service makes a dangerous operation reachable by less-privileged local users without sufficient access restrictions, so an attacker with an existing low-privileged foothold can leverage the service's SYSTEM context. The CVSS vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the attack is local, requires low privileges, needs no user interaction, and has high confidentiality, integrity, and availability impact with unchanged scope. The vulnerability is not reachable over the network and cannot be triggered without prior local code execution. Trend Micro's Zero Day Initiative documented the issue as ZDI-CAN-27668 / ZDI-25-1172.
Know when Superantispyware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L and PR:L because the attacker needs existing low-privileged local code execution; AC:L and UI:N per advisory; C/I/A:H as the result is full SYSTEM control.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27668.
Executive ViewAI
RealDefense SUPERAntiSpyware Professional contains a local privilege escalation flaw that allows an attacker with existing low-level access on an endpoint to gain SYSTEM-level control, potentially disabling endpoint defenses or enabling deeper compromise. Because the vulnerable SAS Core Service runs by default, any affected workstation or server with the product installed is exposed to this escalation path. Leadership should prioritize remediation planning given the product's role in endpoint security and the absence of a vendor-released patch.
Enforce least privilege and restrict local interactive logon on endpoints running RealDefense SUPERAntiSpyware Professional; monitor for suspicious privilege escalation and SYSTEM-level process creation; consider temporarily stopping or restricting the SAS Core Service where operationally feasible; implement application allowlisting and endpoint detection; engage the vendor for a patch timeline and consider product replacement if no vendor-released patch is identified.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Superantispyware
View allIn SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYS
SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivilege
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Pri
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a low-privileged local attacker to escala
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker with existing low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already has low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already holds low-privilege
GitHub PoC
Exploit-DB