CVE-2025-14488: SUPERAntiSpyware Privilege Escalation Flaw

CVE-2025-14488 Overview

CVE-2025-14488 is a local privilege escalation vulnerability in RealDefense SUPERAntiSpyware. The flaw resides in the SAS Core Service, which exposes a dangerous function accessible to low-privileged users. An attacker with the ability to execute code on the target system can leverage the exposed function to run arbitrary code in the context of SYSTEM.

The issue is tracked under [CWE-749: Exposed Dangerous Method or Function] and was reported through the Zero Day Initiative as ZDI-CAN-27657.

Critical Impact

Successful exploitation grants SYSTEM-level code execution on Windows hosts running vulnerable versions of SUPERAntiSpyware, enabling full host compromise from a low-privileged account.

Affected Products

• RealDefense SUPERAntiSpyware Professional
• SUPERAntiSpyware installations bundling the vulnerable SAS Core Service
• Windows endpoints running the affected security product

Discovery Timeline

• 2025-12-23 - CVE-2025-14488 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14488

Vulnerability Analysis

The vulnerability exists in the SAS Core Service, a privileged Windows service component of SUPERAntiSpyware. The service exposes a function to lower-privileged callers that should be restricted to trusted or SYSTEM-context operations.

Because the service runs as SYSTEM, any operation the exposed function performs inherits SYSTEM privileges. A local attacker who can invoke the function from a standard user context can direct the service to execute attacker-controlled logic. This produces a direct crossing of a privilege boundary within a single host.

The Zero Day Initiative advisory ZDI-25-1167 documents the finding. No public proof-of-concept is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is classified as [CWE-749: Exposed Dangerous Method or Function]. The SAS Core Service exposes an interface reachable from low-integrity processes without sufficient authentication, authorization, or input validation. Sensitive operations that should be constrained to internal callers are instead available to any local user.

Attack Vector

Exploitation requires local access with the ability to execute low-privileged code. The attacker interacts with the exposed interface of the SAS Core Service, invokes the dangerous function, and coerces the service into performing a privileged action on the attacker's behalf. The result is arbitrary code execution as NT AUTHORITY\SYSTEM.

Refer to the Zero Day Initiative Advisory ZDI-25-1167 for the technical description of the exposed function and the interaction pattern.

Detection Methods for CVE-2025-14488

Indicators of Compromise

• Unexpected child processes spawned by the SAS Core Service process running under the SYSTEM account.
• New services, scheduled tasks, or persistence artifacts created shortly after inter-process communication with the SAS Core Service by a non-privileged user session.
• File writes or registry modifications in SYSTEM-protected locations attributed to the SUPERAntiSpyware service without corresponding update or scan activity.

Detection Strategies

• Monitor process lineage where the SAS Core Service is the parent of interactive shells such as cmd.exe, powershell.exe, or rundll32.exe.
• Alert on IPC connections (named pipes, COM, RPC, LPC) to the SAS Core Service originating from standard user sessions followed by privileged file or registry operations.
• Baseline expected behavior of the SUPERAntiSpyware service and flag deviations, particularly command-line arguments passed to spawned processes.

Monitoring Recommendations

• Enable Windows process creation auditing (Event ID 4688) with command-line logging on endpoints running SUPERAntiSpyware.
• Forward endpoint telemetry to a centralized data lake to correlate low-privileged user activity with SYSTEM-context executions.
• Track version and patch status of SUPERAntiSpyware installations across the fleet using software inventory tooling.

How to Mitigate CVE-2025-14488

Immediate Actions Required

• Inventory all endpoints with SUPERAntiSpyware Professional installed and prioritize hosts where standard users have interactive access.
• Apply the vendor update as soon as RealDefense releases a fixed build referenced by ZDI-25-1167.
• Restrict local logon rights on affected systems to reduce the population of accounts able to reach the exposed interface.

Patch Information

At publication, the enriched CVE data does not list a vendor advisory URL or a fixed version. Consult the Zero Day Initiative Advisory ZDI-25-1167 and the RealDefense SUPERAntiSpyware support channels for the current remediation guidance and patched release.

Workarounds

• If no patch is available, consider stopping and disabling the SAS Core Service on high-risk multi-user systems until a fix is deployed.
• Uninstall SUPERAntiSpyware on hosts where its functionality is not required.
• Apply application control policies to prevent unauthorized processes from interacting with the SAS Core Service IPC interface.

# Example: query and disable the SAS Core Service on Windows as a temporary workaround
sc.exe query SASCORE
sc.exe stop SASCORE
sc.exe config SASCORE start= disabled