SUPERAntiSpyware Professional
CVE-2025-14494
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged code execution on host
-
DeliveryLocate exposed SAS Core Service function
-
ExploitInvoke dangerous function with crafted input
-
ExecutionExecute arbitrary code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Exploitation requires that SUPERAntiSpyware Professional be installed and its SAS Core Service running on the target Windows host, and that the attacker already possess the ability to execute low-privileged code locally (a valid low-privilege foothold, PR:L, AV:L). There is no remote vector and no user interaction is needed. The limiting factors are therefore: the product must be present (a non-ubiquitous consumer AV), the attacker must already have local code execution, and the affected version must be installed - this is strictly a post-compromise escalation primitive, not an initial-access flaw. |
| Impact | This is a genuine but bounded risk. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: the attacker needs to already run low-privileged code on the host (AV:L, PR:L), but once there, exploitation is low-complexity (AC:L), needs no user interaction (UI:N), and yields full C/I/A impact by executing code as SYSTEM. No EPSS score, CISA KEV entry, or public POC is present in the provided data, so exploitation probability signals are entirely absent rather than low - this is a data gap, not evidence of low risk. The SSVC-relevant facts (exposed dangerous function per CWE-749, deterministic SYSTEM-level technical impact) suggest exploitation would be reliable once a working technique exists, but automatability is unknown. The signals are internally consistent: the description explicitly states local, low-privilege prerequisites matching the AV:L/PR:L vector, so there is no network-vs-local conflict to flag. Net: a real post-compromise escalation primitive on affected hosts, appropriately rated HIGH, but not an internet-facing or wormable threat - prioritize for endpoints where SUPERAntiSpyware is installed, below any remotely-exploitable items. |
| Exploit ScenarioDerived | An attacker who has already achieved low-privileged code execution on a Windows host (e.g., via phishing or a standard user account) invokes the exposed dangerous function in the SAS Core Service to run arbitrary code as SYSTEM, gaining full control of the machine. No user interaction is required and attack complexity is low. No public exploit code was identified in the provided data, so this reflects the ZDI-described technique rather than a confirmed in-the-wild chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already has low-privileged code execution call an exposed dangerous function in the SAS Core Service and gain SYSTEM-level code execution. The flaw affects installations with the service running and is a post-compromise escalation primitive, not an initial-access vector; no public exploit code or CISA KEV entry was identified at time of analysis.
RemediationAI
No vendor-released fixed version is identified in the provided data, so the primary action is to check RealDefense's support channels and the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-25-1163/) for an updated SUPERAntiSpyware Professional build and apply it as soon as it is available. Because exploitation requires pre-existing local code execution, the most effective compensating controls are to enforce least privilege and application control (WDAC or AppLocker) so untrusted code cannot run on hosts with the SAS Core Service, and to restrict interactive logon to such hosts. If the product is not operationally required, uninstalling it removes the attack surface; disabling the SAS Core Service may also block the exposed function but will break real-time protection and other SUPERAntiSpyware features, so treat that as a temporary trade-off. Monitor endpoint telemetry for low-privileged processes spawning SYSTEM-level children from the SAS Core Service, and investigate any unexpected process creation attributable to that service.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-749 (Exposed Dangerous Function or Method), meaning the SAS Core Service-a privileged Windows service that supports SUPERAntiSpyware's real-time protection-exposes a callable routine that should be restricted to trusted callers. A local low-privilege process can invoke that routine to cross a security boundary and execute code in the service's SYSTEM context. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the attack is local, requires only low privileges, needs no user interaction, and yields high confidentiality, integrity, and availability impact without a scope change. The CPE cpe:2.3:a:superantispyware:superantispyware:*:*:*:*:professional:*:*:* scopes affected installations to the Professional edition, and ZDI tracks the disclosure as ZDI-CAN-27676 / ZDI-25-1163.
Know when Superantispyware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an existing low-privilege local foothold (AV:L, PR:L) but is deterministic with no user interaction (AC:L, UI:N), and yields full SYSTEM-level code execution (C/I/A:H).
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27676.
Executive ViewAI
SUPERAntiSpyware Professional is affected by a high-severity local privilege escalation in its SAS Core Service that could let an attacker with an existing low-privileged foothold on an endpoint gain SYSTEM-level control. This is a post-compromise escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis, but successful exploitation would deepen an intruder’s control of affected Windows systems and could support credential theft, defense evasion, and lateral movement. Leadership should treat endpoints running the SAS Core Service as requiring prioritized inventory and risk reduction until a vendor fix is available.
No vendor-released patch identified at time of analysis. Interim mitigations include uninstalling SUPERAntiSpyware Professional where not required, stopping and disabling the SAS Core Service on affected hosts, enforcing least privilege and restricting low-privileged code execution, monitoring for anomalous SAS Core Service activity and SYSTEM-level process creation, and ensuring EDR coverage on all affected endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Superantispyware
View allIn SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYS
SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivilege
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Pri
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a low-privileged local attacker to escala
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker with existing low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already holds low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
GitHub PoC
Exploit-DB