Apple Mail CVE-2026-28929

Apple Mail must be running on a device with Lockdown Mode explicitly enabled in system settings (Settings > Privacy & Security > Lockdown Mode on iOS/iPadOS, or System Settings > Privacy & Security > Lockdown Mode on macOS), which represents a non-default configuration used primarily by high-risk users. The victim must actively compose a reply to an email message-simply viewing or receiving emails does not trigger the vulnerability. The attacker must craft an email containing remote image references (HTML IMG tags with external URLs) and successfully deliver it to the victim's inbox, which requires bypassing any mail filtering or spam controls. Exploitation is limited by the requirement for user-initiated reply action (not automatic), the relatively small population of Lockdown Mode users (reducing target pool), and the fact that the vulnerability only discloses metadata rather than enabling code execution or full system compromise. The CVSS UI:N rating appears inconsistent with the actual requirement for user reply interaction.

Real-world risk requires careful contextual evaluation despite the 7.5 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) technically rates this as network-exploitable without authentication or user interaction, but this overlooks critical exploitation prerequisites: the victim must have Lockdown Mode enabled AND must actively reply to an attacker-controlled email. The high confidentiality impact (C:H) reflects potential IP address disclosure and email client metadata leakage. However, EPSS score of 0.02% (5th percentile) indicates security researchers assess actual exploitation probability as very low, likely because Lockdown Mode users represent a small, security-conscious population who may recognize email-based attacks. No CISA KEV listing or public POC suggests no confirmed active exploitation. The primary risk is to high-value targets already using Lockdown Mode (journalists, activists, executives facing nation-state threats) where even metadata disclosure enables correlation attacks and physical location tracking. For general enterprise environments not using Lockdown Mode, this vulnerability has zero impact. SSVC decision factors: exploitation status is none, automatable is no (requires social engineering to elicit reply), technical impact is partial (information disclosure only, no code execution).

An attacker targeting a high-profile individual known to use Lockdown Mode (journalist covering sensitive topics, corporate executive, political dissident) sends a benign-appearing email containing tracking pixel references in hidden IMG tags. When the victim replies to the email while Lockdown Mode is active-expecting full protection-Apple Mail incorrectly loads the remote images, sending HTTP requests to attacker-controlled servers that capture the victim's IP address, email client version, approximate geographic location via IP geolocation, and timestamp of activity. The attacker correlates this metadata with other intelligence sources to determine the victim's physical location or travel patterns.