Vulnerability · Published Oct 13, 2026 · Assigned by NCSC-NL

CVE-2026-103316The macOS version of the DigiD app is not signed with Hardened Runtime

High 7.1

In plain English

A high-severity privilege mismanagement in DigiD for macOS from Logius. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.1%top 99.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy)

Affected products (as reported)

Vendor	Product	Versions
Logius	DigiD for macOS	<6.19.2

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Apple AppStore Digid for macOS patch