This vulnerability allows an application on Apple iOS and iPadOS devices to enumerate the list of installed apps on a user's device, potentially exposing sensitive privacy information. Apple fixed this issue by removing the sensitive data that allowed such enumeration. The fix is included in iOS 18.7.7, iPadOS 18.7.7, and corresponding updates for macOS, tvOS, visionOS, and watchOS. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality and availability to a limited extent.

An attacker-controlled app could gain knowledge of other installed applications on the device, which may reveal user behavior or preferences, constituting a privacy breach. The impact is limited to confidentiality loss with no direct integrity or availability compromise. There are no reports of active exploitation in the wild.

Apple has released official fixes in iOS 18.7.7, iPadOS 18.7.7, and related OS versions. Users and administrators should apply these updates to remediate the vulnerability. Since this is not a cloud service, patching the affected devices is required. Patch status is confirmed by the vendor advisory indicating the issue is fixed in these versions.