This vulnerability arises from inadequate enforcement of user‑defined privacy settings in Apple’s mail handling. The system fails to honor the “Hide IP Address” preference, allowing an email’s originating IP address to be visible to anyone who examines the message header or content. In addition, the “Block All Remote Content” option may not be applied to every piece of mail, letting external web resources load even when the user has opted to block them. The effect is a privacy breach that enables tracking and potential execution of remote content without user consent.

Apple iOS 26.4 and earlier, iPadOS 26.4 and earlier, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5 and macOS Tahoe 26.4 are impacted. Any device running a version prior to the fixes listed in the Apple support references is potentially vulnerable.

The CVSS score of 5.3 reflects a moderate impact; the EPSS score of under 1 % indicates a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been observed in the wild at large scale. Exploitation would occur via crafted email content that takes advantage of the disregard for the privacy preferences, primarily affecting mail users who rely on these settings to prevent IP leakage or remote content loading.