A permissions flaw allows an application to enumerate the other applications installed on an Apple device. The weakness, classified as CWE-276, permits the disclosure of user-installed apps, which can be used for profiling or tailoring additional attacks. The impact is purely informational and does not directly compromise the device's core functionality.

Apple iOS and iPadOS devices running firmware prior to iOS 18.7.2, iPadOS 18.7.2, iOS 26.1, or iPadOS 26.1 are vulnerable. The issue is fixed in both 18.7.2/26.1 releases of the operating systems.

The CVSS score of 3.3 indicates low severity. An exploit requires a local malicious application; no remote exploitation or privilege escalation is needed. The EPSS score of less than 1% indicates a very low exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a user installing a malicious or poorly designed application that requests permissions to enumerate installed apps.