CVE catalog

CVE-2026-28929

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an email could display r

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.41% · Oct 25, 2026

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an email could display remote images in Mail in Lockdown Mode.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpeipadosNot reported18.7.9fixed
Cpeiphone_osNot reported18.7.9fixed
CpemacosNot reported14.8.7fixed
CpemacosNot reported15.7.7fixed
CpemacosNot reported26.5fixed
CpeipadosNot reported18.7.9fixed
Cpeiphone_osNot reported18.7.9fixed
CpemacosNot reported26.5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpeipadoscpeNot reported18.7.9Not reportedNot reportedNot reported
Cpeiphone_oscpeNot reported18.7.9Not reportedNot reportedNot reported
CpemacoscpeNot reported14.8.7Not reportedNot reportedNot reported
CpemacoscpeNot reported15.7.7Not reportedNot reportedNot reported
CpemacoscpeNot reported26.5Not reportedNot reportedNot reported
CpeipadoscpeNot reported18.7.9Not reportedNVD-CVE-2026-28929Not reported
Cpeiphone_oscpeNot reported18.7.9Not reportedNVD-CVE-2026-28929Not reported
CpemacoscpeNot reported26.5Not reportedNVD-CVE-2026-28929Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)]