CVE-2025-14489CWE-749

CVE-2025-14489

High · published December 24, 2025

CVSS v3.0
7.8
EPSS
0%
Percentile
10.0
In the wild
Unconfirmed
What it is

⚡ A local privilege escalation vulnerability in RealDefense SUPERAntiSpyware could allow attackers to leap from low-level access to SYSTEM control! 🚀 Think of it like someone sneaking into a backroom at a restaurant, managing to convince the staff they should be allowed in the kitchen. Once there, they can change the menu, alter orders, or even lock the doors! An attacker with this vulnerability could gain complete control over the system, executing arbitrary code that could lead to data breaches, system manipulation, or even total lockdown of critical resources. This means they could potentially run rampant, impacting not just one machine, but the entire network!

Put simply

Think of it like someone sneaking into a backroom at a restaurant, managing to convince the staff they should be allowed in the kitchen. Once there, they can change the menu, alter orders, or even lock the doors! This vulnerability arises from an exposed dangerous function within the SAS Core Service of RealDefense SUPERAntiSpyware. A local attacker must first run low-privileged code to exploit this flaw and escalate their privileges to SYSTEM level.

What to do

An attacker with this vulnerability could gain complete control over the system, executing arbitrary code that could lead to data breaches, system manipulation, or even total lockdown of critical resources. This means they could potentially run rampant, impacting not just one machine, but the entire network! To mitigate this risk, ensure that your installation of RealDefense SUPERAntiSpyware is updated to the latest version. Regularly review system permissions, and consider restricting user capabilities so that only trusted personnel can execute code. 🛡️ You can tackle this head-on! Keep your systems updated and secure, and you'll keep those pesky attackers at bay! 💪✨

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00205 · 10.0th percentile
Weakness
CWE-749 · Exposed Dangerous Method or Function
Published
2025-12-24T03:15Z
Affected products (1)
ProductVersionsFixed in
superantispyware/superantispyware< 10.0.128010.0.1280
References (1)
EPSS history
Timeline
  • 23 DEC 21:17Z
    RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability
    cvelistv5