CVE-2025-14490
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges by exploiting an exposed dangerous function in the SAS Core Service. The attacker must first obtain the ability to execute low-privileged code. This can lead to code execution as SYSTEM.
Risk Assessment
An attacker can elevate privileges to SYSTEM level, potentially gaining full control over the system. The risk affects workstations with SUPERAntiSpyware installed.
Recommendation
Update SUPERAntiSpyware to the latest version that fixes the vulnerability. Restrict the ability of low-privileged users to execute unknown code.
Other vulnerabilities in SUPERAntiSpyware
See all- CVE-2025-14497High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges by exploiting an exposed dangerous function in the SAS Core Service. The attacker must first obtain the ability to execute low-privileged code. This can lead to code execution as SYSTEM.
- CVE-2025-14496High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges. The flaw is due to an exposed dangerous function in the SAS Core Service, enabling arbitrary code execution with SYSTEM privileges.
- CVE-2025-14495High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges. The flaw is due to an exposed dangerous function in the SAS Core Service, enabling arbitrary code execution with SYSTEM privileges.
- CVE-2025-14494High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges. The flaw is due to an exposed dangerous function in the SAS Core Service, enabling arbitrary code execution with SYSTEM privileges.
- CVE-2025-14493High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges. The flaw is due to an exposed dangerous function in the SAS Core Service, enabling arbitrary code execution with SYSTEM privileges.
- CVE-2025-14492High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges by exploiting an exposed dangerous function in the SAS Core Service. The attacker must first obtain the ability to execute low-privileged code. This can lead to code execution as SYSTEM.
- CVE-2025-14491High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges by exploiting an exposed dangerous function in the SAS Core Service. The attacker must first obtain the ability to execute low-privileged code. This can lead to code execution as SYSTEM.
- CVE-2025-14489High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges by exploiting an exposed dangerous function in the SAS Core Service. The attacker must first obtain the ability to execute low-privileged code. This can lead to code execution as SYSTEM.
- CVE-2025-14488High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges by exploiting an exposed dangerous function in the SAS Core Service. The attacker must first obtain the ability to execute low-privileged code. This can lead to code execution as SYSTEM.
Original NVD description (English source)
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27659.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS