Logitech Options+ vulnerability allows SYSTEM-level privilege escalation

A critical vulnerability in Logitech Options+ software has been discovered, allowing standard Windows users to gain SYSTEM-level privileges. This flaw, tracked as CVE-2026-12518, requires no administrator rights, network access, or additional user interaction for exploitation, according to a recent report by Cyber Insider.

The vulnerability was found in the software's updater service, which runs with extensive operating system access. Security researcher Jake Bolam of AmberWolf Research identified that weaknesses in how the software trusted local processes and handled installation files could be chained together. A standard user could manipulate their own instance of a trusted process to relay commands to the updater, bypassing intended restrictions. Further analysis revealed that the updater accepted user-controlled values that could influence where installation files were loaded from, and a privileged installation routine skipped certificate validation.

By combining these weaknesses, an attacker could place a malicious installer and have the trusted Logitech service launch it with SYSTEM privileges. This would grant the attacker the highest local privilege level on Windows, enabling them to modify protected files, install software, access other users' data, or interfere with security tools. Logitech released a patch on August 19, and users are advised to update to the latest version.

Source: Cyber Insider