A PERIPHERAL PATH TO SYSTEM - EXPLOITING LOGI OPTIONS+ FOR SYSTEM SHELLS

Summary from the TLDR InfoSec newsletter

Logi Options+, Logitech's widely used app for configuring its mice and keyboards, allowed any standard Windows user to reach SYSTEM because its privileged updater trusted only pipe connections from an agent process the user could inject. Researchers at AmberWolf used that access to override the {depot} path via the reinstall IPC endpoint, which directed a SYSTEM msiexec call to an unsigned MSI that skipped signature checks because the manifest set isSystem to true. The bug is tracked as CVE-2026-12518 and was patched on August 19, so admins should confirm that fleets run a newer build and alert on msiexec spawned by logioptionsplus_updater.exe from user-writable paths.