SUPERAntiSpyware Professional
CVE-2025-14495
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExecute low-privileged code on host
-
ExploitInvoke exposed dangerous function in SAS Core Service
-
ImpactExecute arbitrary code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Exploitation requires that SUPERAntiSpyware (Professional edition per the CPE) is installed and its SAS Core Service is running on the target Windows host, and that the attacker already has the ability to execute low-privileged code locally (PR:L, AV:L) - there is no remote or unauthenticated path. The specific trigger is an exposed dangerous function in the SAS Core Service that performs a SYSTEM-privileged operation without adequate caller authorization (CWE-749). Limiting factors: no remote reachability, a required pre-existing local foothold, and dependence on the vulnerable service being installed and active; no user interaction is needed (UI:N). |
| Impact | This is a locally-exploitable privilege escalation (CVSS 3.0 7.8, AV:L/AC:L/PR:L/UI:N) in SUPERAntiSpyware's SAS Core Service, confirmed by the Zero Day Initiative (ZDI-25-1169, formerly ZDI-CAN-27677). The CVSS vector is internally consistent with the description: AV:L and PR:L match the stated requirement that an attacker must already run low-privileged code on the host, and C:H/I:H/A:H matches full SYSTEM compromise. Exploitation status is: no public exploit identified at time of analysis - the CVE is NOT in CISA KEV and no POC is referenced in the provided data. No EPSS score was supplied, so statistical exploitation probability cannot be weighed here. No SSVC decision data was provided. Weighing these signals: the high CVSS reflects the severe SYSTEM-level technical impact and low attack complexity, but real-world urgency is tempered by the local-only attack vector (no remote reach) and the authenticated prerequisite (attacker must already have a foothold). This is a credible second-stage escalation primitive for an attacker who already has code execution, rather than an initial-access or wormable threat. Treat as a solid patch-soon item, not an emergency, absent evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker who has already gained low-privileged code execution on a Windows host running SUPERAntiSpyware Professional (for example via phishing or a separate exploit) invokes an exposed dangerous function in the SAS Core Service. Because the service runs as SYSTEM and exposes the function without adequate authorization, the attacker executes arbitrary code at SYSTEM, taking full control of the machine. No public POC or exploit code is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker with existing low-privileged code execution to invoke an exposed dangerous function in the SAS Core Service and gain SYSTEM-level code execution. The flaw requires local access and a running SAS Core Service, needs no user interaction, and has no remote or unauthenticated path. No public exploit identified at time of analysis.
RemediationAI
No vendor-released patch is identified in the available data. Until a fix is available, reduce the likelihood of exploitation by preventing low-privileged users from executing arbitrary code on hosts running SUPERAntiSpyware Professional, since the flaw requires a local foothold. Consider stopping or disabling the SAS Core Service on systems where it is not required (trade-off: loss of real-time protection and scanning functionality), and enforce least privilege and application control to limit the ability to obtain initial low-privileged execution. Monitor the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-25-1169/ for updates, and apply vendor patches when released.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-749 (Exposed Dangerous Function) occurs when a service or API exposes a function that performs a privileged operation without adequately verifying the caller's authorization. Here, the SAS Core Service, a Windows service running as SYSTEM in SUPERAntiSpyware Professional, exposes a method that a low-privileged local process can invoke to perform a privileged action. The CVSS vector AV:L/PR:L/UI:N confirms local access and low privileges are required, with no user interaction; the vulnerable service must be installed and running. The CPE identifies the Professional edition. The root cause is missing or insufficient caller validation in the service's function interface, allowing a local attacker to escalate to SYSTEM.
Know when Superantispyware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local foothold required (AV:L) by a low-privileged user (PR:L), no complexity or interaction barriers (AC:L/UI:N), yielding full SYSTEM compromise (C:H/I:H/A:H).
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27677.
Executive ViewAI
RealDefense SUPERAntiSpyware Professional contains a high-severity local privilege escalation vulnerability (CVE-2025-14495) that can allow an attacker with existing low-privileged code execution on a host to gain SYSTEM-level control. The risk is concentrated on endpoint devices where an attacker already has a foothold, and successful abuse could undermine endpoint integrity, persistence controls, and lateral movement defenses. Leadership should prioritize inventory and containment of affected endpoints because no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict local interactive access and enforce least privilege on endpoints running RealDefense SUPERAntiSpyware Professional; monitor or restrict invocation of the SAS Core Service; temporarily stop or disable the SAS Core Service where operationally feasible; and maintain endpoint detection and response coverage for local privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Superantispyware
View allIn SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYS
SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivilege
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Pri
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a low-privileged local attacker to escala
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already has low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already holds low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
GitHub PoC
Exploit-DB