Logi Options+ CVE-2026-12518

Exploitation requires the attacker to already hold a low-privileged interactive or remote session on a Windows machine where Logi Options+ is installed and its updater service is in a running state. The vulnerability is not remotely exploitable without prior local access - the CVSS AV:L metric confirms local system presence is mandatory. No special configuration flags, non-default settings, or administrative interaction are required; the vulnerable service runs in its default installed state. Limiting factors include the requirement for local access (ruling out unauthenticated network exploitation), the presence of the Logi Options+ application (endpoints without it are unaffected), and the Windows-only scope of the software. Once local access is established, attack complexity is low with no user interaction required.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) accurately captures a straightforward escalation path with no attack prerequisites beyond a low-privileged local session - even a mid-sized municipal IT team in koszalin deploying Logitech peripherals across a standard Windows fleet should treat this as an urgent remediation item rather than a background task. The publicly available proof-of-concept documented on the amberwolf blog removes any meaningful technical barrier for capable threat actors and raises the practical risk substantially above what the base score alone conveys. No CISA KEV listing has been identified, meaning confirmed in-the-wild exploitation is not established at time of analysis, but the combination of a trivially low attack complexity, working POC, and the near-universal presence of Logitech peripherals in enterprise environments makes this a high-priority local escalation. The 'RCE' tag in the source metadata is a labeling inconsistency - the vulnerability is a local privilege escalation (AV:L), not remote code execution; the 'Microsoft' tag is similarly erroneous for a Logitech-owned product.

An attacker who has obtained a low-privileged Windows session - via phishing, password spray, or lateral movement from another compromised host - identifies a Logi Options+ installation and the associated running updater service. Using the publicly documented technique from the amberwolf blog, the attacker abuses the CWE-269 privilege management flaw in the service's exposed interface to coerce execution of attacker-controlled code as SYSTEM, achieving full local administrative control suitable for credential harvesting, persistence installation, or further lateral movement across the network.