Local Privilege Escalation in Logi Options+ Updater Service

Executive Summary

CVE-2026-12518 is a local privilege escalation flaw in Logitech Logi Options+ updater service on Windows. It allows a low-privileged user to execute arbitrary code as SYSTEM by exploiting weaknesses in the updater's security boundaries, named pipe access control, and certificate validation.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual activity in the Logitech Logi Options+ updater service logs or processes. Look for unexpected SYSTEM-level processes spawned by the updater. Review named pipe access logs for unauthorized connections to the updater service.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local access could gain full SYSTEM privileges, allowing them to install malware, modify system files, or take complete control of the affected machine. No admin rights, user interaction, or network access are required for exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Update Logitech Logi Options+ to the latest version immediately. Disable the updater service if not required. Restrict write permissions to directories used by the updater service. Monitor for suspicious SYSTEM-level processes or installations.

Useful 0 Not Useful 0