CVE-2025-14497: SUPERAntiSpyware Privilege Escalation Flaw

CVE-2025-14497 is a privilege escalation vulnerability in RealDefense SUPERAntiSpyware that allows local attackers to gain SYSTEM-level access through an exposed dangerous function in the SAS Core Service. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-14497 Overview

CVE-2025-14497 is a local privilege escalation vulnerability in RealDefense SUPERAntiSpyware. The flaw resides in the SAS Core Service, which exposes a dangerous function accessible to low-privileged users. A local attacker who can execute code on the target system can abuse this function to run arbitrary code in the context of SYSTEM. The issue is tracked as ZDI-CAN-27680 and disclosed through Zero Day Initiative advisory ZDI-25-1168. It maps to [CWE-749] (Exposed Dangerous Method or Function).

Critical Impact
Successful exploitation grants attackers full SYSTEM-level code execution on affected Windows hosts running SUPERAntiSpyware.

Affected Products

RealDefense SUPERAntiSpyware Professional
SUPERAntiSpyware installations exposing the SAS Core Service
Windows endpoints running vulnerable SUPERAntiSpyware builds

Discovery Timeline

2025-12-23 - CVE-2025-14497 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14497

Vulnerability Analysis

The vulnerability affects the SAS Core Service component of SUPERAntiSpyware. This service runs with SYSTEM privileges and exposes functionality that should be restricted to trusted callers. The exposed function performs sensitive operations without adequate caller validation. A local attacker with the ability to execute low-privileged code on the host can invoke the function directly. The service then performs privileged operations on behalf of the attacker.

See the Zero Day Initiative Advisory ZDI-25-1168 for the technical write-up.

Root Cause

The root cause is an exposed dangerous function [CWE-749] within the SAS Core Service. The service does not enforce sufficient authentication or authorization on the callable interface. Because the service executes with SYSTEM privileges, any operation reachable through that interface inherits those privileges. Local users therefore gain a path to invoke high-privilege operations from a low-privilege context.

Attack Vector

Exploitation requires local access and the ability to run code under a standard user account. The attacker connects to the SAS Core Service interface and invokes the exposed function with attacker-controlled parameters. The service processes the request and executes arbitrary code, load operations, or file actions in the SYSTEM context. User interaction is not required. Network access is not required.

No public proof-of-concept code is available at the time of publication. Refer to the ZDI advisory for further detail.

Detection Methods for CVE-2025-14497

Indicators of Compromise

Unexpected child processes spawned by the SAS Core Service running as NT AUTHORITY\SYSTEM.
Standard-user processes issuing IPC or RPC requests to SUPERAntiSpyware service endpoints.
New service binaries, scheduled tasks, or persistence artifacts created shortly after SUPERAntiSpyware activity by a non-admin user.

Detection Strategies

Monitor process creation events where the parent is a SUPERAntiSpyware service binary and the child is cmd.exe, powershell.exe, rundll32.exe, or other living-off-the-land binaries.
Alert on privilege transitions in which code launched by a standard user produces subsequent activity running as SYSTEM.
Baseline normal SAS Core Service behavior and flag deviations in invoked functions, loaded modules, or spawned processes.

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging on endpoints running SUPERAntiSpyware.
Forward endpoint telemetry to a centralized platform for correlation of service-to-child-process chains.
Track file, registry, and service modifications performed by the SAS Core Service and its child processes.

How to Mitigate CVE-2025-14497

Immediate Actions Required

Inventory all endpoints running RealDefense SUPERAntiSpyware and identify vulnerable installations.
Apply vendor-provided updates to SUPERAntiSpyware as soon as they are made available.
Restrict local logon rights on affected systems to reduce the attacker population able to reach the service.
Monitor the SAS Core Service for anomalous IPC activity and unexpected child processes.

Patch Information

Review the Zero Day Initiative Advisory ZDI-25-1168 for vendor coordination status and remediation guidance. Consult RealDefense/SUPERAntiSpyware release notes for the fixed version and deploy the update across all affected endpoints. Where a fix is not yet available, treat SUPERAntiSpyware as a local attack surface and prioritize compensating controls.

Workarounds

Uninstall or disable SUPERAntiSpyware on high-value systems until a patched build is deployed.
Enforce application allowlisting to prevent execution of untrusted binaries by standard users.
Limit interactive and remote logon on affected hosts to administrative personnel only.

bash

# Query SUPERAntiSpyware service state and stop it pending vendor patch
sc.exe query "SASCore"
sc.exe stop "SASCore"
sc.exe config "SASCore" start= disabled