EUVD Vulnerability Catalog

EUVD-2026-98312

Severity: HIGH Base Score: 7.1 CVSS Version: 3.1

Vulnerability Description

The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy)

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

▪ Attack Vector (AV): Local

▪ Attack Complexity (AC): Low

▪ Privileges Required (PR): Low

▪ User Interaction (UI): None

▪ Scope (S): Unchanged

▪ Confidentiality Impact (C): High

▪ Integrity Impact (I): High

▪ Availability Impact (A): None

Affected Vendors & Systems

Vendor Logius

References & Advisory Links

https://apps.apple.com/us/app/digid/id1208460960

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

NCSC-NL

EPSS Probability

Known Aliases

GHSA-w7v9-fjxv-67ff CVE-2026-103316

Published On

2026-10-13

Last Updated

2026-10-13