CVE-2025-14491: SUPERAntiSpyware Privilege Escalation Flaw

CVE-2025-14491 is a privilege escalation vulnerability in RealDefense SUPERAntiSpyware that allows local attackers to gain SYSTEM-level privileges through an exposed dangerous function in the SAS Core Service. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-14491 Overview

CVE-2025-14491 is a local privilege escalation vulnerability in RealDefense SUPERAntiSpyware. The flaw resides in the SAS Core Service and stems from an exposed dangerous function [CWE-749]. A local attacker with the ability to execute low-privileged code can leverage the exposed function to escalate privileges and execute arbitrary code in the context of SYSTEM. The issue was reported through the Zero Day Initiative as ZDI-CAN-27660 and published under advisory ZDI-25-1164.

Critical Impact
Successful exploitation grants SYSTEM-level code execution on affected Windows hosts, giving attackers full control over the endpoint.

Affected Products

SUPERAntiSpyware Professional (all versions prior to the vendor fix)
Installations running the SAS Core Service
Windows endpoints with RealDefense SUPERAntiSpyware deployed

Discovery Timeline

2025-12-23 - CVE-2025-14491 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14491

Vulnerability Analysis

The vulnerability exists within the SAS Core Service, a Windows service component of SUPERAntiSpyware that runs with SYSTEM privileges. The service exposes a dangerous function to lower-privileged callers without adequate access control. A local, authenticated attacker can invoke this function through its exposed interface and cause the service to perform privileged operations on the attacker's behalf.

Because the SAS Core Service executes as SYSTEM, any code it runs or file it touches inherits SYSTEM-level authority. The vulnerability affects confidentiality, integrity, and availability of the host, allowing an attacker to install persistence, tamper with security controls, or read protected memory.

Exploitation requires prior code execution on the target, so the flaw is typically chained with an initial access vector such as phishing, browser exploitation, or credential theft to reach full host compromise.

Root Cause

The root cause is classified under [CWE-749] Exposed Dangerous Method or Function. The SAS Core Service exposes an interface that permits low-privileged users to trigger sensitive functionality intended only for privileged callers. The service fails to validate the caller's identity or restrict which functions can be invoked over the interface.

Attack Vector

The attack vector is local. An attacker who has already obtained low-privileged code execution on the endpoint interacts with the SAS Core Service through its exposed interface. By invoking the dangerous function with attacker-controlled parameters, the adversary directs the SYSTEM-level service to perform actions such as loading arbitrary code, writing to protected paths, or launching processes with elevated tokens. See the Zero Day Initiative Advisory ZDI-25-1164 for additional technical context.

No verified public proof-of-concept code is available at the time of publication. The vulnerability mechanism is described in prose only.

Detection Methods for CVE-2025-14491

Indicators of Compromise

Unexpected child processes spawned by the SAS Core Service (SASCore.exe or related service binaries) running as SYSTEM.
New or modified files written to protected directories such as C:\Program Files\SUPERAntiSpyware\ by non-administrator users.
Unusual inter-process communication or named pipe connections originating from low-privileged user processes to the SAS Core Service.

Detection Strategies

Monitor for local privilege transitions where a process created by a standard user account results in a SYSTEM-integrity child process parented by SUPERAntiSpyware components.
Alert on loading of unsigned or unusual modules by the SAS Core Service process.
Correlate service-related Windows event logs (Event IDs 7045, 4697) with process creation events referencing SUPERAntiSpyware binaries.

Monitoring Recommendations

Enable command-line and process-creation auditing (Sysmon Event ID 1, Windows Event ID 4688) on hosts running SUPERAntiSpyware.
Track integrity-level escalations between parent and child processes, particularly transitions from Medium to System integrity.
Baseline the normal behavior of the SAS Core Service and alert on deviations such as new IPC endpoints or unexpected file writes.

How to Mitigate CVE-2025-14491

Immediate Actions Required

Inventory all endpoints running SUPERAntiSpyware Professional and identify hosts exposing the SAS Core Service.
Apply the vendor-supplied patch as soon as it is available from RealDefense.
Restrict interactive and remote logon on affected hosts to trusted administrative users until patches are deployed.

Patch Information

RealDefense addresses the vulnerability through an updated release of SUPERAntiSpyware. Refer to the Zero Day Initiative Advisory ZDI-25-1164 and the vendor's product update channel for the fixed version. Apply the latest available build to all endpoints running the SAS Core Service.

Workarounds

If patching is not immediately possible, disable the SAS Core Service on hosts where SUPERAntiSpyware is not actively required.
Enforce application allowlisting to prevent unauthorized low-privileged binaries from executing on managed endpoints.
Remove SUPERAntiSpyware from systems where it is redundant with other endpoint protection controls to reduce the exposed attack surface.

bash

# Configuration example: stop and disable the SAS Core Service on Windows
sc.exe stop "SASCore"
sc.exe config "SASCore" start= disabled