The macOS DigiD application is not signed with Hardened Runtime, allowing a local user to set the DYLD_INSERT_LIBRARIES environment variable and inject a malicious dynamic library. This injection gives the attacker arbitrary code execution inside the DigiD process, enabling direct access to stored user data and cryptographic functions that the application normally protects. The resulting breach exposes both confidentiality and integrity of the user’s DigiD credentials and any other sensitive information the app handles.

The affected product is Logius DigiD for macOS. No specific version range is detailed; any installation of DigiD on macOS that is not signed with Hardened Runtime is potentially vulnerable.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is not provided, and it is not listed in the CISA KEV catalog. The required attack Prerequisite is local user-level code execution, meaning the attacker must already be able to run code on the target machine. Because the vulnerability permits entry of arbitrary libraries, a successful exploitation would allow the attacker to execute malicious code with the same privileges as the DigiD process, potentially allowing complete compromise of credentials and cryptographic assets.