CVE-2026-103316: Vulnerability in Logius DigiD for macOS
Description
The macOS version of the DigiD app lacks Hardened Runtime signing, allowing a local attacker to inject malicious dynamic libraries via DYLD_INSERT_LIBRARIES. This enables arbitrary code execution within the DigiD app, potentially exposing sensitive DigiD data and cryptographic functions. The vulnerability affects versions prior to 6.19.2 and has a high severity rating.
CVSS v3.1
Score 7.1high
Affected software
Logius
DigiD for macOS
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-103316 describes a vulnerability in the macOS DigiD app where the absence of Hardened Runtime signing permits local processes to load arbitrary dynamic libraries into the DigiD app using the DYLD_INSERT_LIBRARIES environment variable. This can be exploited by an attacker with local user-level code execution privileges to run arbitrary code within the DigiD app context, thereby accessing sensitive data and cryptographic capabilities that are normally protected. The vulnerability affects DigiD for macOS versions before 6.19.2 and has a CVSS 3.1 score of 7.1, indicating high severity.
Potential Impact
An attacker with local user-level access can exploit this vulnerability to execute arbitrary code inside the DigiD app on macOS. This can lead to unauthorized access to DigiD data and cryptographic functions, potentially compromising user credentials and sensitive authentication information. There is no indication of remote exploitation or denial of service impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor for updates from Logius and apply any official fixes once available. Until a fix is released, restricting local user access and avoiding untrusted code execution on affected systems can reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- NCSC-NL
- Date Reserved
- 2026-09-30T11:59:04.230Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acdd4612cdf04f6563560c9
Added to database: 10/13/2026, 06:49:05 UTC
Last enriched: 10/13/2026, 07:03:15 UTC
Last updated: 10/13/2026, 07:08:12 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.