A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows

CVE-2026-12518 is a local privilege escalation in the Logitech Logi Options+ updater service on Windows. Versions >= 1.88.0 and < 2.7.0 are affected. The updater runs as NT AUTHORITY\SYSTEM and is supposed to only accept commands from Logitech's trusted background agent — but a standard user can manipulate their own instance of that agent to relay commands to the service. The updater also accepts user-controlled path values for installation files and skips certificate validation on one of its privileged installation routines. Chain those three together and a standard-privilege local user drops a malicious MSI in a writable directory, redirects the updater to it, and gets code execution as SYSTEM. Discovered by Jake Bolam of AmberWolf Research in February 2026, patched August 19 in builds 2.7.954611 and 2.7.961922, publicly disclosed September 14.

The calculated CVSS 4.0 vector scores 8.5 HIGH (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), which accurately reflects the *technical* chain: low complexity, no interaction, standard-user to SYSTEM. But that score ignores deployment context entirely. Logi Options+ is a workstation peripheral management tool for Logitech mice and keyboards. It does not run on domain controllers, hypervisors, CI/CD infrastructure, or backup servers. The blast radius is strictly one host with no scope change. Requiring local access means the attacker is already past initial access — this is a post-compromise amplifier, not an entry point. A MEDIUM assessment better reflects the real enterprise risk.

Why this verdict

• Local access prerequisite: AV:L means the attacker is already past initial access. This is a post-compromise amplifier, not an entry point. Every host in the chain requires a separate prior compromise.
• Single-host blast radius, no scope change: SYSTEM on one workstation is valuable to an attacker but does not directly propagate. The CVSS vector explicitly shows SC:N/SI:N/SA:N — no impact beyond the compromised host.
• Role multiplier: negligible. Logi Options+ is deployed on *workstations* for peripheral management. It is never installed on domain controllers, hypervisors, CI/CD servers, backup infrastructure, or network edge appliances. 100% of the installed base occupies low-value or typical-value workstation roles. There is no high-value-role deployment scenario where this component's compromise leads to domain/fleet/supply-chain impact. The blast radius floor does not apply.
• No exploitation pressure: Not KEV-listed, EPSS at 0.1%, no known campaigns, no standalone PoC tool. The detailed writeup enables reproduction but the local-only prerequisite limits mass exploitation.
• Patch already available for 28 days: Builds 2.7.954611/961922 have been shipping since August 19. The window for opportunistic exploitation against unpatched endpoints is narrowing.

Why not higher?

The CVSS 4.0 vector calculates to 8.5 HIGH, but that score reflects the mechanical chain quality without deployment context. Logi Options+ never occupies a high-value infrastructure role — it manages mice and keyboards. There is no scope change, no remote attack surface, no in-the-wild exploitation, and no KEV listing. Upgrading to HIGH would overstate the enterprise risk of a local-only workstation peripheral tool.

Why not lower?

The chain is genuinely low-friction once local access is obtained: no admin rights needed, no user interaction, no race conditions, and the certificate bypass means the attacker's payload doesn't need signing. A detailed technical writeup from AmberWolf provides enough information for skilled operators to reproduce. This is a real and usable LPE that red teams will adopt — LOW would understate the practical utility for post-compromise operations.

1. Inventory and patch Logi Options+ via Intune/SCCM — Push builds 2.7.954611+ to all managed Windows endpoints. This is the definitive fix. Since the noisgate verdict is MEDIUM, there is no mitigation SLA — target remediation within the 365-day window, but given the patch is already available and deployment is straightforward, aim to include it in your next scheduled software update cycle.
2. Enable WDAC or AppLocker MSI enforcement — Windows Defender Application Control in enforce mode blocks unsigned MSI execution regardless of the invoking process, which breaks Step 4 of the chain. This is useful as defense-in-depth even after patching.
3. Monitor Logitech updater child processes via EDR — Create a detection rule for the Logi Options+ updater service (LogiOptionsUpdater.exe or similar) spawning unexpected child processes, especially msiexec.exe with non-Logitech MSI paths. This catches exploitation attempts.
4. Restrict Logi Options+ to users who need it — If your peripheral fleet doesn't require Options+ features (gesture controls, Flow, per-app settings), uninstall it entirely. Logitech peripherals work with basic HID drivers. Reducing the installed base eliminates the attack surface.

Run on each target Windows host with standard user privileges. Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-12518.ps1. No admin rights required — the script only reads installed software metadata.

# Check-CVE-2026-12518.ps1
# Checks whether Logitech Logi Options+ is installed and vulnerable to CVE-2026-12518
# Vulnerable: >= 1.88.0 and < 2.7.0
# Outputs: VULNERABLE / PATCHED / UNKNOWN

$ErrorActionPreference = 'Stop'
$exitCode = 2  # UNKNOWN default

try {
    # Search both 64-bit and 32-bit uninstall registry hives
    $regPaths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    $logiApp = $null
    foreach ($path in $regPaths) {
        $logiApp = Get-ItemProperty -Path $path -ErrorAction SilentlyContinue |
            Where-Object { $_.DisplayName -like '*Logi Options*' -or $_.DisplayName -like '*LogiOptions*' } |
            Select-Object -First 1
        if ($logiApp) { break }
    }

    if (-not $logiApp) {
        Write-Host 'UNKNOWN - Logi Options+ not found on this system.'
        exit 2
    }

    $rawVersion = $logiApp.DisplayVersion
    if (-not $rawVersion) {
        Write-Host "UNKNOWN - Logi Options+ found but version string is empty."
        exit 2
    }

    Write-Host "Detected Logi Options+ version: $rawVersion"

    # Parse version - handle both semantic (2.7.0) and build (2.7.954611) formats
    $parts = $rawVersion.Split('.')
    $major = [int]$parts[0]
    $minor = [int]$parts[1]

    # Vulnerable: >= 1.88.0 and < 2.7.0
    $vulnerable = $false
    if ($major -eq 1 -and $minor -ge 88) {
        $vulnerable = $true
    } elseif ($major -eq 2 -and $minor -lt 7) {
        $vulnerable = $true
    }

    if ($vulnerable) {
        Write-Host "VULNERABLE - Logi Options+ $rawVersion is in the affected range (>= 1.88.0, < 2.7.0). Update to 2.7.954611 or later."
        $exitCode = 1
    } else {
        Write-Host "PATCHED - Logi Options+ $rawVersion is outside the vulnerable range."
        $exitCode = 0
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    $exitCode = 2
}

exit $exitCode

Sources

1. CyberInsider – Logitech Options+ flaw lets attackers gain Windows SYSTEM privileges
2. IT-Connect – Logitech Options+ CVE-2026-12518: SYSTEM Privilege Escalation
3. OffSeq Threat Radar – CVE-2026-12518 Intelligence
4. Strix.ai – CVE-2026-12518 CVSS Analysis
5. VulDB – CVE-2026-12518
6. AmberWolf Research Blog
7. Logitech Logi Options+ Security Whitepaper