CVE-2025-30426 is a critical information disclosure vulnerability in Apple iOS and iPadOS where an application may enumerate the list of installed apps on a user's device without proper authorization. This issue was mitigated by Apple through additional entitlement checks to restrict unauthorized app enumeration. The fix is included in iOS 18.4, iPadOS 18.4 and 17.7.6, and corresponding updates for other Apple platforms. The vulnerability is rated with a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker-controlled app could gain unauthorized knowledge of all installed applications on a user's device, potentially exposing sensitive user information or enabling targeted attacks. The vulnerability affects confidentiality, integrity, and availability as per the CVSS vector, indicating severe risk if exploited.

Apple has released official fixes for this vulnerability in iOS 18.4, iPadOS 18.4 and 17.7.6, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, and watchOS 11.4. Users and administrators should update affected devices to these versions or later to remediate the issue. No additional mitigation steps are indicated beyond applying these updates.