A permissions issue in iOS and iPadOS allowed an application to enumerate every app installed on a device. The resulting disclosure does not compromise user data directly but reveals the presence of specific third‑party software, potentially enabling targeted attacks or privacy analysis. The vulnerability is classified as Information Exposure (CWE‑200).

Vulnerable systems include all Apple iOS and iPadOS devices running a version earlier than 18.3. The issue is resolved in iOS 18.3 and iPadOS 18.3, so any device with an older operating system is affected.

The CVSS score of 5.3 indicates moderate impact. An EPSS score of less than 1% suggests the exploitation likelihood is very low. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Because the flaw operates through application‑level permissions and requires the user to run the malicious app, the likely attack vector is local via a legitimate‑looking third‑party app. Updating to 18.3 or later mitigates this risk.