Description

The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the macOS version of the DigiD app, thereby gaining access to DigiD data and cryptographic capabilities that the process normally does not have. Reported by Kun Peeks (@SwayZGl1tZyyy)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-10-13T07:16:30.490Z",
  "pubdate": "2026-10-13T07:16:30.490Z",
  "executiveSummary": "The macOS application DigiD is susceptible to a library injection vulnerability due to the absence of the Hardened Runtime security feature. This deficiency allows an attacker with local user-level code execution to manipulate the application's environment variables to force the loading of arbitrary dynamic libraries (dylibs). By leveraging the DYLD_INSERT_LIBRARIES environment variable, an unauthorized actor can execute malicious code within the context of the DigiD process. This vulnerability compromises the integrity and confidentiality of the application, potentially exposing sensitive user data and privileged cryptographic operations that the process is authorized to perform. The risk is significant as it facilitates process hollowing or code injection, effectively bypassing the security boundary normally enforced by macOS for protected applications. Successful exploitation requires an attacker to already possess local user-level code execution capabilities on the host system.",
  "technicalDetails": "The root cause of this vulnerability is the failure to enable the Hardened Runtime capability during the code signing process of the DigiD macOS application. Hardened Runtime is a mandatory macOS security feature that protects applications against various code injection techniques, specifically by restricting the loading of untrusted dylibs and preventing the use of task_for_pid or debugging APIs on the process.\nWithout Hardened Runtime, the dynamic linker (dyld) respects the DYLD_INSERT_LIBRARIES environment variable when launching the DigiD binary. An attacker who has achieved local code execution can spawn the DigiD application while prepending an arbitrary malicious dylib to this environment variable. Upon initialization, the linker will map the attacker-supplied library into the address space of the DigiD process before the execution of the main entry point.\nThe attack flow proceeds as follows: 1) The attacker compiles a malicious dylib designed to hook sensitive APIs or exfiltrate data from the DigiD application's memory space. 2) The attacker executes the DigiD process (e.g., via execve or a shell command) while setting the DYLD_INSERT_LIBRARIES environment variable to point to the malicious dylib. 3) The dyld linker loads the injected library into the application's process memory. 4) The injected code executes within the DigiD security context, inheriting the application's entitlements, file system permissions, and cryptographic capabilities. 5) The attacker utilizes this process context to bypass identity verification, access stored cryptographic keys, or intercept sensitive communications conducted by the DigiD client.\nThis vulnerability is strictly local, requiring the attacker to already have established access on the macOS workstation. However, because it allows for elevation of capability within the context of a high-trust identity application, it represents a critical threat to user data security. The lack of Hardened Runtime effectively removes the primary macOS defense against binary-level instrumentation and dynamic code injection, making the application an easy target for local lateral movement or data theft."
}