CVE-2025-14494: SUPERAntiSpyware Privilege Escalation Flaw

CVE-2025-14494 is a local privilege escalation vulnerability in RealDefense SUPERAntiSpyware that allows attackers to gain SYSTEM-level access through exposed dangerous functions in SAS Core Service. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-14494 Overview

CVE-2025-14494 is a local privilege escalation vulnerability in RealDefense SUPERAntiSpyware. The flaw resides in the SAS Core Service, which exposes a dangerous function to low-privileged callers. An attacker with the ability to execute code on the target system can abuse this exposed interface to run arbitrary code in the context of SYSTEM. The issue is tracked as ZDI-CAN-27676 and disclosed through Zero Day Initiative advisory ZDI-25-1163. The vulnerability is classified under [CWE-749: Exposed Dangerous Method or Function].

Critical Impact
Local attackers can escalate from a standard user account to full SYSTEM privileges on any Windows host running the affected SUPERAntiSpyware product.

Affected Products

SUPERAntiSpyware Professional (all versions matching cpe:2.3:a:superantispyware:superantispyware:*:*:*:*:professional:*:*:*)
SAS Core Service component installed with SUPERAntiSpyware
Windows endpoints running the affected SUPERAntiSpyware installations

Discovery Timeline

2025-12-23 - CVE-2025-14494 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14494

Vulnerability Analysis

The vulnerability lives inside the SAS Core Service, a privileged Windows service installed by SUPERAntiSpyware. The service exposes a function that performs security-sensitive operations without properly restricting which callers can invoke it. A low-privileged local user can reach this exposed function and direct it to carry out actions using the service's SYSTEM token.

Because SAS Core Service runs at SYSTEM, any operation it executes on behalf of an attacker inherits that privilege level. This gives the attacker a straightforward path from a standard user session to full control over the operating system, including installing drivers, disabling security tooling, and creating persistent administrative accounts.

Root Cause

The root cause is an exposed dangerous function inside the SAS Core Service, mapped to [CWE-749]. The service publishes an interface intended for internal or administrative use but does not enforce sufficient authorization checks on the caller. This design flaw treats any local requester as trusted, collapsing the privilege boundary between the standard user desktop and the SYSTEM-level service.

Attack Vector

Exploitation requires local access and low privileges. No user interaction is needed. An attacker who has already achieved code execution as a limited user (through phishing, a browser exploit, or stolen credentials) interacts with the SAS Core Service and invokes the exposed function to perform an operation that yields code execution as SYSTEM.

No public proof-of-concept exploit is currently listed for CVE-2025-14494. Technical details are described in the Zero Day Initiative Advisory ZDI-25-1163.

Detection Methods for CVE-2025-14494

Indicators of Compromise

Unexpected child processes spawned by the SAS Core Service running as NT AUTHORITY\SYSTEM.
New services, scheduled tasks, or local administrator accounts created shortly after SAS Core Service activity by a non-administrative user.
Loading of unsigned or unexpected modules into the SAS Core Service process address space.

Detection Strategies

Monitor process-creation telemetry for SYSTEM-context children of the SAS Core Service that were triggered by a standard user session.
Alert on inter-process communication (named pipes, LPC, COM) originating from low-privileged processes and targeting the SAS Core Service.
Correlate file-system and registry writes performed by SUPERAntiSpyware processes with the security context of the initiating user.

Monitoring Recommendations

Enable command-line and process-tree logging on all endpoints running SUPERAntiSpyware Professional.
Baseline normal SAS Core Service behavior so anomalous privileged actions surface quickly.
Forward endpoint telemetry to a centralized analytics platform to hunt for privilege-transition patterns across the fleet.

How to Mitigate CVE-2025-14494

Immediate Actions Required

Inventory all Windows hosts running SUPERAntiSpyware Professional and identify systems exposing the SAS Core Service.
Restrict interactive and remote logon on affected hosts to trusted administrative users until a patch is applied.
Increase monitoring around the SAS Core Service process and its child processes on unpatched endpoints.

Patch Information

No vendor advisory or patched version is referenced in the NVD entry at the time of publication. Administrators should consult the vendor directly and review the Zero Day Initiative Advisory ZDI-25-1163 for the latest remediation guidance. Apply any RealDefense-issued update to SUPERAntiSpyware as soon as it becomes available.

Workarounds

Where operationally acceptable, stop and disable the SAS Core Service on affected hosts until a fix is released.
Remove SUPERAntiSpyware Professional from systems where it is not strictly required.
Enforce application allowlisting to block untrusted binaries from executing and reaching the exposed service interface.

bash

# Configuration example: disable the SAS Core Service on Windows
sc.exe stop "SASCORE"
sc.exe config "SASCORE" start= disabled