A logic flaw in Apple iOS and iPadOS allows an application to enumerate the list of other applications installed on the device, exposing sensitive user behavior. This defect falls under a confidentiality breach (CWE‑200) and can reveal the presence of privacy‑sensitive apps or user activity patterns.

Apple’s iOS and iPadOS operating systems are affected. The vulnerability applies to all releases prior to iOS 18.5 and iPadOS 18.5, which contain the fix. Versions older than 18.5 remain susceptible.

The CVSS score of 7.7 reflects a high severity for information disclosure. The EPSS score of less than 1% indicates a very low probability of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, and no exploits have been reported publicly. The likely attack vector is a legitimate or sideloaded app that includes a code path capable of requesting and reading the installed‑app list, which an attacker can use to infer user behavior.