CVE-2025-14495CWE-749

CVE-2025-14495

High · published December 24, 2025

CVSS v3.0
7.8
EPSS
0%
Percentile
9.9
In the wild
Unconfirmed
What it is

⚡ A sneaky privilege escalation vulnerability in RealDefense SUPERAntiSpyware can turn a lowly user into a SYSTEM-level superhero — if they can just get their foot in the door! 🔓 Think of it like a janitor who finds a hidden staircase leading straight to the penthouse suite — once there, they can do just about anything! This flaw in the SAS Core Service lets an attacker start with low privileges but then elevate themselves to full control of the system. The consequences of this vulnerability are potentially devastating. An attacker with access to execute low-privileged code could escalate their privileges and run arbitrary code with SYSTEM rights, effectively taking over the entire machine! If exploited, they could manipulate system files, install malicious software, or even steal sensitive information.

Put simply

Think of it like a janitor who finds a hidden staircase leading straight to the penthouse suite — once there, they can do just about anything! This flaw in the SAS Core Service lets an attacker start with low privileges but then elevate themselves to full control of the system. This vulnerability exists due to an exposed dangerous function within the SAS Core Service of RealDefense SUPERAntiSpyware. It allows local attackers, after gaining execute permissions, to escalate their privileges to SYSTEM and run arbitrary code.

What to do

The consequences of this vulnerability are potentially devastating. An attacker with access to execute low-privileged code could escalate their privileges and run arbitrary code with SYSTEM rights, effectively taking over the entire machine! If exploited, they could manipulate system files, install malicious software, or even steal sensitive information. To protect your systems, first, ensure you are running the latest version of RealDefense SUPERAntiSpyware—update to the latest release as soon as possible. Additionally, restrict access to the software so only trusted users can execute code on the system. Regular audits can help identify unauthorized access or potential misuse. You've got this! With these steps, you'll be reinforcing your defenses against this sneaky vulnerability in no time. 🛡️

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00204 · 9.9th percentile
Weakness
CWE-749 · Exposed Dangerous Method or Function
Published
2025-12-24T03:15Z
Affected products (1)
ProductVersionsFixed in
superantispyware/superantispyware< 10.0.128010.0.1280
References (1)
EPSS history
Timeline
  • 23 DEC 21:16Z
    RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability
    cvelistv5