CVE-2026-103316: The macOS version of the DigiD app is not signed with Hardened Runtime
The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLDINSERTLIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Sign the macOS DigiD app with Hardened Runtime enabled to prevent DYLD_INSERT_LIBRARIES from loading attacker-controlled dylibs.
macOS version of the DigiD app Hardened Runtime = enabled
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the macOS version of the DigiD app are exposed when an attacker can already execute code as a local user on the same Mac. The issue does not describe remote exploitation.
What does an attacker need to exploit it?
The attacker needs local user-level code execution and must be able to inject a dylib into the DigiD process using DYLD_INSERT_LIBRARIES. No user interaction is listed as required.
What could an attacker access after successful exploitation?
An attacker can execute arbitrary code in the DigiD app process. This can provide access to DigiD data and cryptographic capabilities available to that process.