iOS CVE-2026-20692

Without a published CVSS vector, EPSS score, or KEV listing, the risk must be assessed through contextual analysis. The attack vector is network-based (remote content can be loaded from attacker-controlled servers), requires no authentication, and impacts confidentiality (IP address disclosure). The privilege level is low (ordinary user in Mail app). However, the lack of technical complexity from the attacker side is offset by the fact that this is a design/implementation failure rather than a cryptographic or logical flaw—exploitation is as simple as sending a specially-crafted email that bypasses the preference filter. The real-world priority is moderate to high because: (1) privacy preference bypass is a breach of user trust and expected security boundaries; (2) IP address leakage enables targeting, fingerprinting, and geolocation; and (3) remote content loading can facilitate tracking or phishing. The absence of CVSS/EPSS scores suggests Apple's assessment prioritized user privacy impact over quantified severity metrics.

An attacker crafts a malicious email containing remote content (images, stylesheets, or embedded objects) and sends it to a target user known to have enabled "Hide IP Address" or "Block All Remote Content" privacy preferences. Upon opening the email, the Mail app fails to properly apply these preferences to the specific content encoding or format used, causing the user's actual IP address to be leaked when loading the remote content or allowing the remote content to load despite the blocking preference. The attacker's server logs the request with the victim's IP address and user-agent information, enabling network reconnaissance, geolocation, and potential phishing or malware delivery campaigns. No public proof-of-concept is currently known, and no evidence of in-the-wild exploitation has been reported.