CVE-2025-14494
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges. The flaw is due to an exposed dangerous function in the SAS Core Service, enabling arbitrary code execution with SYSTEM privileges.
Risk Assessment
An attacker with low privileges can gain full system control, leading to a severe security breach.
Recommendation
Update SUPERAntiSpyware to the latest version that fixes this vulnerability, or restrict access to the service.
Other vulnerabilities in SUPERAntiSpyware
See all- CVE-2025-14497High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges by exploiting an exposed dangerous function in the SAS Core Service. The attacker must first obtain the ability to execute low-privileged code. This can lead to code execution as SYSTEM.
- CVE-2025-14496High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges. The flaw is due to an exposed dangerous function in the SAS Core Service, enabling arbitrary code execution with SYSTEM privileges.
- CVE-2025-14495High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges. The flaw is due to an exposed dangerous function in the SAS Core Service, enabling arbitrary code execution with SYSTEM privileges.
- CVE-2025-14493High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges. The flaw is due to an exposed dangerous function in the SAS Core Service, enabling arbitrary code execution with SYSTEM privileges.
- CVE-2025-14492High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges by exploiting an exposed dangerous function in the SAS Core Service. The attacker must first obtain the ability to execute low-privileged code. This can lead to code execution as SYSTEM.
- CVE-2025-14491High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges by exploiting an exposed dangerous function in the SAS Core Service. The attacker must first obtain the ability to execute low-privileged code. This can lead to code execution as SYSTEM.
- CVE-2025-14490High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges by exploiting an exposed dangerous function in the SAS Core Service. The attacker must first obtain the ability to execute low-privileged code. This can lead to code execution as SYSTEM.
- CVE-2025-14489High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges by exploiting an exposed dangerous function in the SAS Core Service. The attacker must first obtain the ability to execute low-privileged code. This can lead to code execution as SYSTEM.
- CVE-2025-14488High
A vulnerability in RealDefense SUPERAntiSpyware allows local attackers to escalate privileges by exploiting an exposed dangerous function in the SAS Core Service. The attacker must first obtain the ability to execute low-privileged code. This can lead to code execution as SYSTEM.
Original NVD description (English source)
RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27676.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS