CVE-2026-12518— Local privilege escalation in the Logi Options+ updater service on Windows
Quick assessment
Affected
Logitech Logi Options+
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Windows 上罗技 Logi Options+ 更新服务存在本地权限提升漏洞，允许低权限本地用户以 SYSTEM 身份执行任意代码。
Possible ATT&CK Techniques 1 AI
T1548.002 · Bypass User Account Control
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12518
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Local privilege escalation in the Logi Options+ updater service on Windows
Source: CVE Program / CVE List V5
Vulnerability Description
A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Logitech | Logi Options+ | 1.88.0 ~ 2.7.0 | - |
|
II. Public POCs for CVE-2026-12518
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12518
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-12518 (1)
IV. Related Vulnerabilities
Same vendor: Logitech
-
CVE-2024-8258
Insecure Electron Fuses in Logitech Options Plus Allowing Ar -
CVE-2024-8011
Logitech Options 安全漏洞 -
CVE-2024-4031
MEVO WEBCAM APP Windows Unquoted Service Path Vulnerability -
CVE-2024-2537
Electron Code Injection in Logi Tune macOS Application -
CVE-2022-0916
Broken authentication on Logitech Options due to misvalidati
Same weakness: CWE-269
-
CVE-2026-90787
Soarkey StudentManagement Registration Workflow register.htm -
CVE-2026-73470
Apache Syncope: Delegating users can grant unowned Roles -
CVE-2026-90523
jaychouchannel Tourism-Management-System User Register Endpo -
CVE-2026-90501
lenve vhr HrMapper.xml HrInfoController.updateHr privileges -
CVE-2026-90487
Xuxueli xxl-job JobGroupController.java privileges managemen
V. Comments for CVE-2026-12518
No comments yet