Technical impact
A logic flaw in Apple’s Mail application allows remote images to be rendered when a user replies to an email while Lockdown Mode is active. Lockdown Mode is intended to suppress all external content, so this bypass undermines that security boundary. The weakness maps to CWE‑1254 and could expose a user to malicious content or phishing attempts without their knowledge.
Affected Systems
All Apple iOS and iPadOS releases prior to iOS 18.7.9 and iPadOS 18.7.9, and all macOS releases before macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, or macOS Tahoe 26.5 contain the vulnerability. Devices running the patched releases have the logic evaluation corrected and do not allow remote images to appear during replies in Lockdown Mode.
Risk and Exploitability
With a CVSS score of 7.5, the vulnerability is considered moderate to high severity. The EPSS score is below 1% and the issue is not listed in the CISA KEV catalog, indicating a low but non-zero exploitation probability. An attacker may craft a malicious email that a victim replies to while Lockdown Mode is enabled, causing remote images to load and potentially send telemetry or deliver malware. The combination of compromised content filtering and a user‑initiated action lowers the barrier to exploitation, making timely patching important.
