RealDefense SUPERAntiSpyware CVE-2025-14496
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local code execution
-
ExploitInvoke exposed dangerous function in SAS Core Service
-
ExecutionExecute arbitrary code as SYSTEM
-
ImpactFull host compromise / privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Dangerous method exposure prevention
|
| Exploitation Conditions | Exploitation requires the attacker to already possess the ability to execute low-privileged code on a Windows system that has RealDefense SUPERAntiSpyware (Professional) installed with the SAS Core Service running; the attacker then abuses an exposed dangerous function (CWE-749) in that service to reach SYSTEM. Limiting factors: no remote network vector (AV:L), a pre-existing authenticated low-privilege foothold is mandatory (PR:L), and the SAS Core Service must be present and active - so unaffected hosts are those without SUPERAntiSpyware installed. No user interaction is required, which removes a common mitigating barrier once local access is held. |
| Impact | This is a credible, actionable local privilege escalation issue rather than an overhyped high-CVSS finding. The CVSS 3.0 vector (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) is internally consistent with the description: it requires local access (AV:L) and an already-authenticated low-privileged foothold (PR:L), with low attack complexity (AC:L) and no user interaction (UI:N), yielding full C/I/A impact as SYSTEM. There is no EPSS score, no CISA KEV listing, and no public POC provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is a Trend Micro ZDI advisory (ZDI-25-1171, ZDI-CAN-27678), which indicates a coordinated-disclosure finding, not confirmed in-the-wild abuse. No SSVC decision data was supplied. The key limiting factor is that the attacker must already be able to run low-privileged code on the host, so this is a post-compromise escalation primitive rather than an initial-access or remotely-wormable flaw; prioritize it for endpoints where SUPERAntiSpyware is installed and local/standard-user access is plausible, but it is not an emergency internet-facing exposure. |
| Exploit ScenarioDerived | An attacker who already has a standard (low-privileged) user session on a Windows host running SUPERAntiSpyware invokes an exposed dangerous function in the SAS Core Service to run attacker-controlled code in the SYSTEM context. No user interaction is needed and attack complexity is low. No public exploit code was identified in the provided data, though the issue was reported through Trend Micro ZDI. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privileged code execution to abuse an exposed dangerous function in the SAS Core Service and run code as SYSTEM. The flaw affects installations with the SAS Core Service running and requires local access plus a pre-existing low-privilege foothold (CVSS 3.x: AV:L/PR:L), with no user interaction. No public exploit identified at time of analysis, and no CISA KEV status is provided.
RemediationAI
No vendor-released patch identified at time of analysis; track the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-25-1171/) and RealDefense guidance for a fixed build. Because exploitation requires local low-privileged code execution, reduce exposure by removing SUPERAntiSpyware Professional where it is not required or by stopping or disabling the SAS Core Service after confirming the security trade-off (endpoint scanning and protection may be lost). Where the product must remain, use application control such as WDAC or AppLocker and least-privilege logon rights to prevent untrusted local code execution, restrict interactive access to trusted users, and monitor SAS Core Service process creation and child processes for anomalous SYSTEM-level execution; apply the vendor fix as soon as it is released.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the SAS Core Service in SUPERAntiSpyware Professional, identified by CPE cpe:2.3:a:superantispyware:superantispyware:*:*:*:*:professional:*:*:* with a wildcard version in the supplied data. CWE-749 (Exposed Dangerous Method or Function) describes the root cause: the privileged service exposes an operation that should be restricted to trusted callers but lacks sufficient access control, allowing a low-privileged local process to invoke it. In this CVE, successful abuse leads to arbitrary code execution in the SYSTEM context; the assessed vector is local (AV:L), low privileges (PR:L), and no user interaction (UI:N), matching an attacker who already has a local foothold and seeks elevation. The ZDI advisory is ZDI-25-1171.
Know when Superantispyware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only service abuse (AV:L) needing an existing low-privileged account (PR:L) with no special timing (AC:L); SYSTEM-level code execution yields full C/I/A.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27678.
Executive ViewAI
RealDefense SUPERAntiSpyware Professional contains a high-severity local privilege-escalation flaw in its SAS Core Service that can allow an attacker with an existing low-privilege foothold to execute code as SYSTEM on affected endpoints. Because no vendor patch is currently available, leadership should treat installations with the SAS Core Service running as an elevated endpoint-integrity risk and prioritize inventory, service hardening, and monitoring. No public exploit has been identified at time of analysis, but the required local foothold makes post-compromise escalation the primary organizational concern.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling or stopping the SAS Core Service where feasible, restricting local logon and low-privileged code execution, enforcing least privilege and application control, isolating affected endpoints, and monitoring for privilege escalation; apply the vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Superantispyware
View allIn SUPERAntiSpyware Professional Trial 6.0.1254, the SASKUTIL.SYS driver allows privilege escalation to NT AUTHORITY\SYS
SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivilege
In SUPERAntiSpyware Professional Trial 6.0.1254, SUPERAntiSpyware.exe allows DLL hijacking, leading to Escalation of Pri
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
In SUPERAntiSpyware Professional Trial 6.0.1254, the driver file (SASKUTIL.SYS) allows local users to cause a denial of
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a low-privileged local attacker to escala
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker with existing low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already has low-privileged
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already holds low-privilege
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privilege
GitHub PoC
Exploit-DB