CVE-2025-14489: SUPERAntiSpyware Privilege Escalation Flaw

CVE-2025-14489 Overview

CVE-2025-14489 is a local privilege escalation vulnerability in RealDefense SUPERAntiSpyware. The flaw resides in the SAS Core Service component and stems from an exposed dangerous function that low-privileged users can invoke. An attacker who can execute code on the target host can abuse the exposed function to run arbitrary code in the context of SYSTEM. The issue is tracked by the Zero Day Initiative as ZDI-CAN-27658 and categorized under CWE-749: Exposed Dangerous Method or Function.

Critical Impact

A local, low-privileged attacker can escalate to SYSTEM and execute arbitrary code by invoking an exposed function in the SUPERAntiSpyware Core Service.

Affected Products

• RealDefense SUPERAntiSpyware Professional
• SUPERAntiSpyware installations exposing the SAS Core Service
• All versions prior to the vendor-supplied fix (see vendor advisory)

Discovery Timeline

• 2025-12-23 - CVE-2025-14489 published to the National Vulnerability Database
• 2026-06-17 - Last updated in the NVD database
• Vulnerability reported through the Zero Day Initiative as ZDI-25-1165 (ZDI-CAN-27658)

Technical Details for CVE-2025-14489

Vulnerability Analysis

The vulnerability affects the SAS Core Service, a Windows service component of SUPERAntiSpyware that runs with SYSTEM privileges. The service exposes a dangerous function to unprivileged callers without adequate authorization checks. A local attacker with the ability to execute low-privileged code on the machine can reach this function and drive the service into performing privileged operations on the attacker's behalf. Because the operations execute under the service's SYSTEM context, the caller effectively inherits full local privileges. Exploitation does not require user interaction and can be automated to persist across reboots.

Root Cause

The root cause is classified as CWE-749: Exposed Dangerous Method or Function. The SAS Core Service presents an interface (for example, an inter-process communication endpoint, named pipe, or COM method) that should be restricted to trusted callers but is reachable by any local user. Missing caller validation lets attackers invoke the function to perform sensitive actions such as file writes, process creation, or arbitrary command execution as SYSTEM.

Attack Vector

Exploitation is local. An attacker must first gain code execution on the target host at any privilege level, including a standard user session. The attacker then connects to the exposed interface of the SAS Core Service and invokes the dangerous function with attacker-controlled parameters. The service performs the privileged operation, resulting in arbitrary code execution as SYSTEM. Refer to the Zero Day Initiative advisory ZDI-25-1165 for coordinated disclosure details. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2025-14489

Indicators of Compromise

• Unexpected child processes spawned by the SAS Core Service executable running as NT AUTHORITY\SYSTEM.
• New or modified files written to protected directories such as C:\Windows\System32 immediately after IPC activity involving SUPERAntiSpyware.
• Standard user accounts followed by privileged operations without an intervening legitimate elevation event.

Detection Strategies

• Monitor process lineage where the SUPERAntiSpyware service is the parent of cmd.exe, powershell.exe, or other interpreters.
• Alert on non-administrative users opening handles to SUPERAntiSpyware named pipes or COM interfaces.
• Correlate service configuration changes and installation of new persistence artifacts with recent SUPERAntiSpyware IPC activity.

Monitoring Recommendations

• Enable Windows Security auditing for process creation (Event ID 4688) and record command-line arguments.
• Collect Sysmon Event IDs 1 (process create), 7 (image load), and 17/18 (named pipe events) for the SUPERAntiSpyware service.
• Forward endpoint telemetry to a centralized platform to correlate low-privileged user activity with SYSTEM-level operations.

How to Mitigate CVE-2025-14489

Immediate Actions Required

• Inventory all endpoints running RealDefense SUPERAntiSpyware and identify installed versions.
• Apply the vendor-supplied update as soon as it is available through the SUPERAntiSpyware auto-update mechanism.
• Restrict interactive logon and local code execution on hosts running SUPERAntiSpyware to reduce the pool of potential attackers.

Patch Information

Refer to the Zero Day Initiative advisory ZDI-25-1165 for coordinated disclosure information and the current vendor remediation status. Administrators should consult SUPERAntiSpyware release notes for the fixed build that addresses CVE-2025-14489 and deploy it across all affected endpoints.

Workarounds

• Where operationally acceptable, stop and disable the SAS Core Service on affected hosts until a patched build is deployed.
• Apply application allowlisting to prevent unauthorized binaries from executing on endpoints that run SUPERAntiSpyware.
• Limit local user privileges and enforce least-privilege policies to reduce the ability of attackers to obtain the initial low-privileged foothold required for exploitation.

# Temporarily disable the SUPERAntiSpyware Core Service on Windows (PowerShell, admin)
Stop-Service -Name "SASCORE" -Force
Set-Service -Name "SASCORE" -StartupType Disabled