CVE-2025-14496 Overview
CVE-2025-14496 is a local privilege escalation vulnerability in RealDefense SUPERAntiSpyware. The flaw resides in the SAS Core Service and stems from an exposed dangerous function [CWE-749]. A local attacker with the ability to execute low-privileged code on the target host can leverage this exposure to run arbitrary code in the context of SYSTEM. The issue was reported through the Zero Day Initiative as ZDI-CAN-27678 and published as advisory ZDI-25-1171.
Critical Impact
Successful exploitation grants full SYSTEM-level code execution, allowing an unprivileged local user to fully compromise the affected Windows host.
Affected Products
- RealDefense SUPERAntiSpyware Professional
- SAS Core Service component (all versions prior to the vendor fix)
- Windows endpoints running SUPERAntiSpyware
Discovery Timeline
- 2025-12-23 - CVE-2025-14496 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-14496
Vulnerability Analysis
The vulnerability exists within the SAS Core Service, a privileged Windows service installed by SUPERAntiSpyware. The service exposes a dangerous function to lower-privileged callers without adequate authorization checks. A local user can invoke this function through the service's interprocess communication surface and direct it to perform privileged operations on their behalf.
Because the SAS Core Service runs as SYSTEM, any operation dispatched through the exposed function inherits SYSTEM privileges. This produces a direct path from a standard user context to full host compromise. The vulnerability requires prior local code execution but no user interaction and no additional privileges beyond a standard account.
Root Cause
The root cause is classified under [CWE-749]: Exposed Dangerous Method or Function. The SAS Core Service exports functionality that should be restricted to trusted callers but is reachable by any authenticated local process. Missing caller validation and insufficient access control on the service interface allow arbitrary invocation of privileged actions.
Attack Vector
An attacker first establishes low-privileged code execution on a system running SUPERAntiSpyware. The attacker then interacts with the SAS Core Service through its exposed interface and invokes the dangerous function with attacker-controlled parameters. The service processes the request under its SYSTEM token, executing the requested action with elevated privileges. Typical post-exploitation outcomes include arbitrary file operations, service creation, or direct binary execution as SYSTEM.
No verified exploit code is published for this issue. Refer to the Zero Day Initiative Advisory ZDI-25-1171 for vendor-coordinated technical detail.
Detection Methods for CVE-2025-14496
Indicators of Compromise
- Unexpected child processes spawned by the SAS Core Service (SASCore64.exe or related service binaries) running as SYSTEM.
- New services, scheduled tasks, or persistence artifacts created immediately after IPC activity against the SUPERAntiSpyware service.
- Standard user accounts writing to protected paths such as C:\Windows\System32 or C:\Program Files shortly after invoking the SAS Core Service.
Detection Strategies
- Monitor process lineage where a low-privileged user process communicates with the SAS Core Service and is followed by a SYSTEM process performing sensitive operations.
- Alert on non-installer processes writing to or modifying files owned by the SUPERAntiSpyware installation directory.
- Correlate service control manager events and named-pipe or COM interactions with subsequent privileged process creation.
Monitoring Recommendations
- Enable Windows process creation auditing (Event ID 4688) with command-line logging on hosts running SUPERAntiSpyware.
- Forward endpoint telemetry to a centralized analytics platform to identify privilege transitions initiated from standard user sessions.
- Track any changes to the SAS Core Service configuration, binary path, or service account.
How to Mitigate CVE-2025-14496
Immediate Actions Required
- Inventory all Windows endpoints running RealDefense SUPERAntiSpyware and identify hosts exposing the SAS Core Service.
- Apply the vendor update referenced in ZDI-25-1171 as soon as it is available.
- Restrict interactive and remote logon on affected hosts to reduce the population of accounts that can stage local exploitation.
Patch Information
RealDefense has not published a vendor advisory URL in the referenced NVD record. Consult Zero Day Initiative Advisory ZDI-25-1171 and the SUPERAntiSpyware vendor site for the fixed release. Upgrade all SUPERAntiSpyware Professional installations to the patched version once published.
Workarounds
- If patching is not immediately possible, stop and disable the SAS Core Service on non-essential hosts until a fix is deployed.
- Remove SUPERAntiSpyware from systems where an alternative endpoint control is already in place.
- Enforce least-privilege on endpoints and block execution of untrusted binaries from user-writable locations to raise the bar for the prerequisite local code execution step.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
