CVE-2025-14492 Overview
CVE-2025-14492 is a local privilege escalation vulnerability in RealDefense SUPERAntiSpyware. The flaw resides in the SAS Core Service and stems from an exposed dangerous function [CWE-749]. A local attacker with the ability to execute low-privileged code can invoke this function to run arbitrary code in the context of SYSTEM.
The issue was reported through the Zero Day Initiative as ZDI-CAN-27668 and published as advisory ZDI-25-1172. The CVSS 3.0 base score is 7.8. No public exploit or CISA KEV listing exists at the time of publication.
Critical Impact
Successful exploitation grants full SYSTEM-level code execution on affected Windows hosts, allowing attackers to disable security tooling, tamper with the endpoint, and establish persistence.
Affected Products
- RealDefense SUPERAntiSpyware Professional
- SUPERAntiSpyware installations exposing the SAS Core Service
- Windows endpoints running vulnerable SUPERAntiSpyware builds
Discovery Timeline
- 2025-12-23 - CVE-2025-14492 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-14492
Vulnerability Analysis
The vulnerability lives inside the SAS Core Service, a Windows service that runs with SYSTEM privileges as part of SUPERAntiSpyware. The service exposes a function to lower-privileged callers that performs security-sensitive operations without adequate caller authorization or validation.
A local user who can execute code on the machine can reach the exposed function through the service's interprocess interface. Because the service already holds SYSTEM context, any action it performs on behalf of the caller inherits that privilege level. The result is arbitrary code execution as SYSTEM from a standard user session.
This pattern maps to [CWE-749]: Exposed Dangerous Method or Function. The flaw is exploitable only from a local session and does not require user interaction.
Root Cause
The root cause is a design defect. The SAS Core Service exposes a privileged method to unauthenticated or insufficiently authenticated local callers. The service does not enforce an appropriate trust boundary between low-privileged user processes and the SYSTEM context in which it operates.
Attack Vector
Exploitation requires local code execution as a low-privileged user. The attacker connects to the service endpoint exposed by SAS Core Service and invokes the dangerous function with attacker-controlled parameters. Refer to the Zero Day Initiative Advisory ZDI-25-1172 for additional technical detail.
No verified proof-of-concept code has been published. The vulnerability mechanism is described in prose because no vendor patch source or exploit sample is publicly available.
Detection Methods for CVE-2025-14492
Indicators of Compromise
- Child processes of the SAS Core Service executable running as SYSTEM that are not part of normal SUPERAntiSpyware operation.
- Unexpected command shells (cmd.exe, powershell.exe) or LOLBins spawned by the SUPERAntiSpyware service process tree.
- New services, scheduled tasks, or registry Run keys created immediately after interaction with the SUPERAntiSpyware service.
Detection Strategies
- Hunt for anomalous parent-child relationships where the SUPERAntiSpyware core service process launches interactive shells or scripting engines.
- Alert on standard users invoking IPC endpoints exposed by third-party security agents, particularly those running as SYSTEM.
- Correlate low-privilege process activity with subsequent privileged file writes to C:\Windows\System32 or C:\ProgramData paths.
Monitoring Recommendations
- Enable Windows process creation auditing (Event ID 4688) with command-line logging on endpoints running SUPERAntiSpyware.
- Monitor service configuration changes and new service creation events (Event ID 7045) following user logons.
- Track integrity-level transitions where processes originating from a medium integrity user session produce high or system integrity descendants.
How to Mitigate CVE-2025-14492
Immediate Actions Required
- Inventory endpoints running SUPERAntiSpyware Professional and identify installations exposing the SAS Core Service.
- Restrict interactive logon on affected systems to trusted administrators until a fixed build is deployed.
- Apply application allowlisting to prevent unauthorized binaries from invoking the vulnerable service interface.
Patch Information
No vendor advisory URL is listed in the CVE record. Refer to the Zero Day Initiative Advisory ZDI-25-1172 and contact RealDefense/SUPERAntiSpyware support to obtain the fixed release. Upgrade all affected endpoints once the vendor publishes a patched build.
Workarounds
- Where operationally feasible, stop and disable the SAS Core Service on affected hosts until a patched version is installed.
- Remove SUPERAntiSpyware from systems where an alternative endpoint protection product already provides coverage.
- Enforce least privilege for interactive users to reduce the population of accounts that can reach the vulnerable local interface.
# Query and disable the SUPERAntiSpyware core service on Windows (run as Administrator)
sc.exe query "SASCORE"
sc.exe stop "SASCORE"
sc.exe config "SASCORE" start= disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
