A permissions flaw affecting multiple Apple platforms enables malicious applications to bypass privacy restrictions and enumerate installed software, posing a risk to user privacy.

This is a permissions issue where an application can bypass expected sandbox constraints to enumerate installed apps. The vulnerability is unauthenticated, as it allows any installed application to perform the enumeration without specific user privileges.

The ability for an unauthorized application to enumerate installed software provides attackers with significant insight into the user environment. This information can be used to profile targets, identify vulnerable software versions for secondary attacks, and compromise user privacy. With a CVSS score of 7.5, this high-severity flaw represents a notable risk to the confidentiality of the device configuration.

Immediate Action: Update all affected Apple devices to version 26.1 or later to apply the necessary security restrictions.

Proactive Monitoring: Review application permission logs for unexpected calls to system enumeration APIs or suspicious behavior from third-party applications.

Compensating Controls: Enforce mobile device management (MDM) policies to restrict the installation of unauthorized or untrusted applications, which serves as a primary defense against malicious software executing on the device.

Public Exploit Available: Unknown

Given the broad impact across Apple's ecosystem, administrators and individual users should prioritize updating to version 26.1 immediately. This patch effectively closes the permission gap that allows unauthorized software discovery, thereby protecting user privacy and reducing the attack surface against more targeted threats.