SUPERAntiSpyware
CVE-2025-14493
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged local code execution
-
ExploitInteract with SAS Core Service
-
ExecutionInvoke exposed dangerous function
-
ImpactExecute arbitrary code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Requires that SUPERAntiSpyware Professional is installed and its SAS Core Service is running, and that the attacker has already achieved the ability to execute low-privileged code on the target Windows host (local foothold). Exploitation leverages a dangerous function exposed by that service to a lower-privilege context. Limiting factors: no remote vector (AV:L) so the attacker needs prior local access, and the vulnerable SAS Core Service component must be present and active; impact is confined to the local machine (S:U). No user interaction is required (UI:N). |
| Impact | This is a local privilege escalation (CVSS 3.0 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in SUPERAntiSpyware's SAS Core Service, grounded in CWE-749 (exposed dangerous function). The CVSS vector confirms the attacker must already be local and authenticated with low privileges (PR:L) and that no user interaction is needed (UI:N), with low attack complexity (AC:L) yielding full SYSTEM-level confidentiality, integrity and availability impact. Weighing all signals: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is referenced - the only source is the ZDI advisory (ZDI-25-1170). There is therefore no evidence of active or at-scale exploitation; this is a credible but not urgent finding. Severity is driven by impact (SYSTEM code execution) rather than by reachability, since exploitation is gated behind an existing local foothold. Net: a real, legitimate privilege-escalation issue worth patching on affected hosts, but not a drop-everything internet-facing emergency - it functions as a post-compromise escalation primitive rather than an initial-access vector. Note the input 'RCE' tag overstates reach: the description and AV:L both make this LOCAL code execution, not remote. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged account or has run unprivileged malware on a Windows host with SUPERAntiSpyware Professional installed interacts with the SAS Core Service and invokes an exposed dangerous function. This elevates them from limited user to SYSTEM, enabling full control of the machine. No public exploit is identified at time of analysis, so this would require custom tooling against the service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already holds low-privileged code execution on a Windows host abuse a dangerous function exposed by the SAS Core Service to run code as SYSTEM. Only machines running the Professional edition with the SAS Core Service active are exposed, and the attack cannot be launched remotely because it requires a prior local foothold (CVSS 3.0 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-749). No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue was reported through Trend Micro ZDI (ZDI-CAN-27675 / ZDI-25-1170), which remains the primary source of remediation status.
RemediationAI
No vendor-released patch with a specific fixed version number was identified in the available data, so confirm the current remediation status directly in the ZDI advisory ZDI-25-1170 (https://www.zerodayinitiative.com/advisories/ZDI-25-1170/), which documents the vendor's response and any update guidance; if RealDefense has published a fixed build, upgrade SUPERAntiSpyware Professional endpoints to it and verify the SAS Core Service version afterwards. Until a fix is confirmed deployed, the practical compensating controls all trade functionality for reduced attack surface: stop and disable the SAS Core Service on hosts where real-time protection is not required (this removes the vulnerable interface but also disables the product's protection features, so it is only appropriate for systems where SUPERAntiSpyware is not the primary endpoint defense), or restrict who can interact with the service by tightening the service DACL and removing interactive logon rights for standard users on sensitive machines. Because the exploit prerequisite is low-privileged code execution, the highest-leverage mitigation is preventing that initial foothold through application control, phishing-resistant authentication, and prompt patching of browsers and Office; additionally, monitor Security event logs for unusual service-control or named-pipe/RPC access to SAS Core Service processes and alert on non-admin processes spawning SYSTEM-owned children from the SUPERAntiSpyware installation directory.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-749 (Exposed Dangerous Method or Function), meaning the SAS Core Service - a privileged Windows service installed with SUPERAntiSpyware Professional - exposes an interface or callable routine to a lower-privileged context that should not be reachable by standard users. Because the service runs at high privilege, any caller able to invoke that function can have it perform privileged operations on their behalf, turning a routine local unprivileged process into a SYSTEM-level execution primitive. The CVSS vector confirms the boundaries of the issue: AV:L means the attacker must already be executing code on the box, PR:L means only low privileges are needed beforehand, UI:N means no victim interaction, and S:U means the impact stays on the compromised host rather than crossing a virtualization or authority boundary. The CPE entry identifies the Professional edition of SUPERAntiSpyware as the affected product; the generic zip-slip-style or memory-corruption classes do not apply here - this is a trust-boundary design weakness in the service's exposed API surface rather than a parsing bug.
Know when Superantispyware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attacker with an existing low-privileged foothold (AV:L, PR:L) reaches an exposed dangerous service function with no interaction, escalating to SYSTEM for full C/I/A impact.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27675.
Executive ViewAI
RealDefense SUPERAntiSpyware Professional endpoint agents contain a local privilege-escalation flaw that lets an attacker who already holds a foothold on a Windows host elevate to SYSTEM, turning a limited compromise into full administrative control of that device. Because exploitation requires pre-existing local code execution and no public exploit or confirmed active exploitation was identified at time of analysis, the organizational risk is concentrated on endpoints running the Professional edition with the SAS Core Service active, particularly high-value systems where attackers might chain this after initial access. Leadership should care because an unpatchable SYSTEM-level escalation on a security product can undermine endpoint detection, containment, and incident response until the vendor ships remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: inventory and tag hosts running SUPERAntiSpyware Professional with the SAS Core Service active; enforce least privilege and remove unnecessary local admin rights; apply application allowlisting to prevent untrusted code from invoking the SAS Core Service; disable or restrict the SAS Core Service on endpoints where it is not operationally required and substitute alternate protection; add EDR detections for anomalous SYSTEM-level process creation from SAS Core Service; monitor for post-exploitation behavior and engage RealDefense/ZDI for patch status.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Superantispyware
View allIn SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYS
SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivilege
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Pri
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a low-privileged local attacker to escala
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker with existing low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already has low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
GitHub PoC
Exploit-DB