CVE-2026-103316
Received Received - Intake

DYLD_INSERT_LIBRARIES Code Execution in DigiD macOS App

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: National Cyber Security Centre Netherlands (NCSC-NL)

Description
The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-103316
EUVD
EUVD-2026-98312

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Logius DigiD for macOS <6.19.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The macOS version of the DigiD app lacks Hardened Runtime signing, allowing a local attacker to inject a malicious dylib into the app using DYLD_INSERT_LIBRARIES. This grants arbitrary code execution within the app, potentially accessing sensitive DigiD data and cryptographic functions.

Detection Guidance

This vulnerability is specific to the macOS version of the DigiD app and involves improper code signing. Detection requires checking if the DigiD app is running without hardened runtime and if dylib injection is possible. Use commands like 'codesign -dv /Applications/DigiD.app' to verify signing and 'ps aux | grep DigiD' to check running processes. Look for unexpected dylib loads with 'lsof -p $(pgrep DigiD) | grep .dylib'.

Impact Analysis

An attacker with local access to your macOS device could exploit this to steal your DigiD credentials, personal data, or perform actions on your behalf. This could lead to identity theft or unauthorized access to government services.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data processed by DigiD. It may also breach Dutch privacy laws governing DigiD's data handling, as the app processes sensitive identity information without adequate protection.

Mitigation Strategies

Immediately uninstall the macOS version of the DigiD app until an update with Hardened Runtime is released. Avoid using the app on macOS. Monitor official DigiD channels for patches. Use alternative authentication methods if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103316. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart