CVE-2026-28929: Apple iPadOS Information Disclosure Flaw

CVE-2026-28929 Overview

CVE-2026-28929 is a logic flaw in Apple Mail that affects iOS, iPadOS, and macOS. When a user replies to an email while Lockdown Mode is enabled, Mail can display remote images that should have been blocked. Lockdown Mode is Apple's optional protection designed to reduce the attack surface for users targeted by sophisticated threats. The defect weakens that protection by allowing remote content to load during the reply workflow. Apple addressed the issue with improved checks in iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. The weakness is categorized under [CWE-1254] (Incorrect Comparison Logic Granularity).

Critical Impact
A remote attacker can confirm message receipt, track recipient activity, and harvest IP and client metadata by sending an email that loads remote images when the target replies, bypassing a core Lockdown Mode protection.

Affected Products

Apple iOS versions prior to 18.7.9
Apple iPadOS versions prior to 18.7.9
Apple macOS Sequoia prior to 15.7.7, macOS Sonoma prior to 14.8.7, and macOS Tahoe prior to 26.5

Discovery Timeline

2026-05-11 - CVE-2026-28929 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-28929

Vulnerability Analysis

The vulnerability resides in Apple Mail's handling of remote content during the reply composition flow. Lockdown Mode is intended to block automatic loading of remote images in email to prevent tracking pixels and other network-based reconnaissance. The reply code path failed to apply the same content restrictions enforced when viewing the original message. As a result, remote image URLs embedded by the sender are fetched when the user composes a reply.

An attacker who controls the remote image server learns the recipient's IP address, approximate geolocation, user agent, and the time the reply was initiated. This information is valuable for confirming a live target before deploying follow-on payloads. Targeted users who rely on Lockdown Mode such as journalists, activists, and government personnel are the primary risk population.

Root Cause

The root cause is an incorrect granularity check in Mail's content policy enforcement. The logic that gates remote resource loading evaluated the message view context but did not cover the reply composition context. The fix introduces improved checks so that Lockdown Mode restrictions extend across all message rendering paths.

Attack Vector

Exploitation requires no authentication and no user interaction beyond replying to an attacker-supplied email. The attacker crafts an HTML email containing a remote image reference pointing to a server they control. When the Lockdown Mode user opens the reply window, Mail issues the network request and reveals the recipient as active.

No verified public exploit code is available for this issue. The mechanism is described in Apple's security advisories listed under references.

Detection Methods for CVE-2026-28929

Indicators of Compromise

Outbound HTTP or HTTPS requests from Mail processes (Mail.app, MobileMail) to unfamiliar image hosting domains shortly after an inbound message arrives
Repeated retrievals of the same remote image URL across multiple recipients, suggesting a tracking pixel campaign
Mail network activity originating from devices configured with Lockdown Mode enabled

Detection Strategies

Inspect proxy and DNS logs for image fetches correlated with mail receipt timestamps on managed Apple endpoints
Hunt for embedded remote image tags in inbound email at the secure email gateway and flag external image hosts not on allow-lists
Compare installed OS build numbers against the patched releases to identify devices still exposed to CVE-2026-28929

Monitoring Recommendations

Track Apple device OS version inventory and alert on devices running pre-patch builds of iOS, iPadOS, or macOS
Monitor egress traffic from Mail clients on high-risk user devices and baseline normal image-loading behavior
Review email gateway telemetry for senders that repeatedly include remote images targeting executive or high-risk mailboxes

How to Mitigate CVE-2026-28929

Immediate Actions Required

Update affected devices to iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, or macOS Tahoe 26.5
Prioritize patching for users who have Lockdown Mode enabled, as the protection they rely on is the one being bypassed
Communicate the issue to high-risk users and instruct them to avoid replying to unsolicited messages until the update is applied

Patch Information

Apple released fixes in iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. Refer to the vendor advisories: Apple Support Document #127111, Apple Support Document #127115, Apple Support Document #127116, and Apple Support Document #127117.

Workarounds

Disable HTML rendering or use plain text mode in Mail for accounts that receive untrusted messages
Route inbound mail through a secure email gateway that strips remote image references from messages before delivery
Avoid replying to suspicious or unsolicited messages on unpatched devices, since the reply action triggers the remote fetch

bash

# Verify the installed macOS build matches a patched release
sw_vers -productVersion

# Verify the installed iOS or iPadOS build from a connected host
ideviceinfo -k ProductVersion