CVE-2024-8258: Insecure Electron Fuses in Logitech Options Plus Allowing Arbitrary Code Execution on macOS

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-09-10 · updated 2026-06-17
Weakness: CWE-94

Description

Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration.

Affected products

Logitech Logi Options+: from 1.60.496306 before 1.70.551909 — fixed in 1.70.551909

How to fix

Upgrade to a fixed version: Logitech Logi Options+ 1.70.551909. Check the vendor advisory for mitigations.

References

https://github.com/r3ggi/electroniz3r
https://nvd.nist.gov/vuln/detail/CVE-2023-49314
https://nvd.nist.gov/vuln/detail/CVE-2023-50643
https://www.electronjs.org/docs/latest/tutorial/fuses

Get alerted when CVE-2024-8258 or the next vulnerability affects your stack