A flaw in entitlement checks allows an application to enumerate a user’s installed apps, exposing the presence of software that may imply sensitive user behavior or preferences. This weakness is a classic information‑disclosure problem classified as CWE‑200. The high CVSS score of 9.8 indicates that the vulnerability is severe and could substantially compromise user privacy if exploited. The description does not detail how the attack is triggered, but the likely attack vector is a malicious or compromised application running with standard user privileges, from which a developer or attacker could enumerate installed apps.

Apple’s operating systems are impacted: iOS 18.4, iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, and watchOS 11.4. Versions earlier than these releases are vulnerable.

The CVSS score of 9.8 signals a high severity rating, but the EPSS figure of less than 1 % indicates a very low likelihood that the vulnerability will be actively exploited at present. The vulnerability is not listed in CISA’s KEV catalog. The exploit would involve a malicious app on the device obtaining a list of installed applications, which could enable privacy‑breaching or credential‑guessing attacks. Because the vulnerability can be triggered by any application lacking proper entitlement checks, the attack privilege is a normal user-level app, making it broadly exploitable if no patch is applied.