Apple operating systems grant an application privileged access to enumerate a user’s installed app list. This permissions flaw exposes details about the user’s software ecosystem, potentially revealing user preferences or low‑level system information. The weakness corresponds to an information‑exposure vulnerability that can be leveraged to gain non‑confidential data about the device and its user.

Devices running Apple iOS, iPadOS, macOS, or visionOS versions earlier than release 26.4 are affected. The flaw is fixed in iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4; any device still on an older build remains at risk.

The CVSS base score of 6.2 indicates moderate severity, while the EPSS score of less than 1 % reflects a low likelihood of exploitation in the current threat landscape. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is likely local: a malicious or compromised application with sufficient permissions can invoke the enumeration API to enumerate installed apps. No remote exploitation channels are described, so the threat to systems without compromised applications is limited.