A logic flaw in Apple’s operating systems causes remote images to be fetched even when the user has disabled the ‘Load Remote Images’ setting. This bypasses the expected privacy control and is classified as CWE‑359. The vulnerability enables unintended disclosure of user information or tracking vectors, compromising confidentiality while not delivering direct code execution.

All Apple platforms running versions prior to the fixes are exposed. This includes iOS versions earlier than 18.7.2 and 26.1, iPadOS versions earlier than 18.7.2 and 26.1, macOS Sequoia versions earlier than 15.7.2 and Tahoe versions earlier than 26.1, and visionOS and watchOS versions earlier than 26.1.

The CVSS score of 7.5 indicates a Medium‑High severity, while the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Likely attack vectors involve the delivery of malicious or deceptive content—such as compromised apps, phishing websites, or e‑mails—that references remote images. The flaw would function locally or remotely wherever the attacker can influence content, thereby presenting a privacy threat rather than a system‑wide denial of service or code execution risk.