An application running on an Apple device can enumerate the list of installed applications because the operating system does not adequately enforce authorization checks. The patch introduces improved checks, but until the update is applied a malicious or compromised app could retrieve a full list of local apps, revealing the user’s software usage and potentially exposing sensitive personal habits. This information‑exposure weakness allows unauthorized disclosure of the installed‑app list.

Apple’s iOS, iPadOS, macOS (Tahoe), tvOS, visionOS, and watchOS versions released before 26.4 are affected. The 26.4 updates for each platform contain the fix that introduces stricter checks to block unauthorized enumeration.

The CVSS base score of 4 reflects moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, further implying limited threat. Because enumeration occurs only when a local application is present, the attack vector is a malicious or compromised app deployed on the device, not a remote exploit.