Mail can display remote images when forwarding an email while the device is in Lockdown Mode, potentially exposing sensitive information or unintended content to the recipient. The vulnerability stems from the system’s behavior of rendering remote image content without user consent, which could be exploited to harvest data about the device or its user, and in some contexts could lead to malicious code execution via crafted image payloads. The weakness is described as a failure to sanitize or block remote image requests, aligned with CWE‑940.

Apple iOS and iPadOS devices running versions earlier than 18.6. The issue is fixed in iOS 18.6 and iPadOS 18.6. Mail is the specific application affected, and only the Lockdown Mode context allows the vulnerability to be exercised.

The CVSS score is 4.7, indicating a medium severity. The EPSS score is below 1 %, suggesting very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and no active exploit is reported. Attackers would need to convince a user to forward an email while the device is in Lockdown Mode; consent or local user action is typically required, making exploitation less likely but still possible through social engineering.