CVE-2025-14490 Overview
CVE-2025-14490 is a local privilege escalation vulnerability in RealDefense SUPERAntiSpyware. The flaw resides in the SAS Core Service, which exposes a dangerous function to low-privileged callers. An attacker who can already execute code on the target system can leverage this exposure to run arbitrary code in the context of SYSTEM. The issue is classified under [CWE-749: Exposed Dangerous Method or Function]. It was reported to the vendor through the Zero Day Initiative program as ZDI-CAN-27659 and published in advisory ZDI-25-1166.
Critical Impact
Successful exploitation grants attackers full SYSTEM-level control of the host, undermining the security posture of the very endpoint the anti-spyware product is meant to protect.
Affected Products
- RealDefense SUPERAntiSpyware Professional
- SAS Core Service component
- Installations exposing the vulnerable service interface to local users
Discovery Timeline
- 2025-12-23 - CVE-2025-14490 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-14490
Vulnerability Analysis
The vulnerability exists in the SAS Core Service, a privileged component distributed with SUPERAntiSpyware. The service exposes a function that performs sensitive operations without adequately restricting which callers may invoke it. Any user able to execute code on the host can reach that interface and instruct the service to act on their behalf.
Because the SAS Core Service runs with SYSTEM privileges, operations it performs on behalf of an untrusted caller inherit those privileges. This turns a limited user account into a full administrative foothold on the endpoint. The weakness is tracked as [CWE-749], which covers cases where a product exposes a method or function that provides high-privilege capabilities to unauthorized actors.
Root Cause
The root cause is missing authorization enforcement on an exposed interface. The service treats calls from local low-privileged processes as trusted and performs privileged actions without validating the caller's rights. There is no consent boundary between the untrusted invoker and the privileged code path.
Attack Vector
Exploitation is local. An attacker first needs the ability to run code as a standard user, obtained through phishing payloads, malicious installers, or lateral movement from an initial compromise. The attacker then invokes the exposed function offered by the SAS Core Service to execute arbitrary code as SYSTEM. User interaction is not required, and the attack complexity is low.
No public proof-of-concept, exploit code, or entry on the CISA Known Exploited Vulnerabilities catalog is available at the time of publication. Refer to the Zero Day Initiative advisory for coordinated disclosure details.
Detection Methods for CVE-2025-14490
Indicators of Compromise
- Unexpected child processes spawned by the SAS Core Service running as NT AUTHORITY\SYSTEM.
- New service creation, scheduled task registration, or local account modification originating from the SUPERAntiSpyware service process tree.
- Anomalous file writes to protected directories (for example C:\Windows\System32) attributed to the SUPERAntiSpyware service.
Detection Strategies
- Baseline the normal child processes of SUPERAntiSpyware executables and alert on deviations, especially interactive shells such as cmd.exe or powershell.exe.
- Correlate a low-privileged process opening a handle or IPC channel to the SAS Core Service with subsequent privileged actions on the same host.
- Apply behavioral analytics that flag privilege transitions from a standard user context to SYSTEM without a legitimate parent chain.
Monitoring Recommendations
- Enable Windows process creation auditing (Event ID 4688) with command-line logging on endpoints running SUPERAntiSpyware.
- Forward endpoint telemetry to a centralized SIEM or data lake for cross-host hunting of anomalous SAS Core Service activity.
- Monitor for installation or presence of unpatched SUPERAntiSpyware builds through software inventory tooling.
How to Mitigate CVE-2025-14490
Immediate Actions Required
- Inventory endpoints running SUPERAntiSpyware Professional and prioritize workstations with multiple interactive users or shared access.
- Apply the vendor-supplied update as soon as it is available from RealDefense and verify the SAS Core Service version after patching.
- Restrict local user execution on affected hosts through application control policies until patching is complete.
Patch Information
RealDefense has been notified through the Zero Day Initiative disclosure process. Consult the ZDI-25-1166 advisory and the vendor's support channels for the fixed release. No dedicated vendor advisory URL is listed in the current NVD record.
Workarounds
- Where feasible, stop and disable the SAS Core Service on hosts that cannot be patched immediately, accepting the loss of scanning functionality.
- Enforce least-privilege on endpoints so that untrusted users cannot execute arbitrary binaries that would reach the vulnerable interface.
- Segment high-value systems from general user workstations to limit the impact of a successful local escalation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
