An application running on an Apple device can now list all other applications installed on that device because the operating system fails to enforce proper authorization checks. This gives the app an unintended view into the user’s installed software, which can reveal personal usage habits and potentially expose sensitive information. The flaw is an information‑exposure weakness that permits unauthorized disclosure of the installed‑app list.

Apple’s iOS, iPadOS, macOS (Tahoe), tvOS, visionOS, and watchOS versions released before 26.4 are affected. The 26.4 updates for each platform contain the fix that introduces stricter checks to block unauthorized enumeration.

The CVSS base score of 4 reflects moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, further implying limited threat. Because enumeration occurs only when a local application is present, the attack vector is a malicious or compromised app deployed on the device, not a remote exploit.