CVE-2026-103316
The macOS version of the DigiD app is not signed with Hardened Runtime.
Published Oct 13, 2026 · updated Oct 14, 2026
The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy)
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · NIST NVD
Detected
The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported b
Oct 14, 2026 · NIST NVD
Updated
The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported b
Sources
- CVE.orgCVE-2026-103316
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-103316
30-day exploitation probability 0.1%
first.org - NIST NVDCVE-2026-103316
The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app
nvd.nist.gov