CVE-2025-24089: Apple iPadOS Information Disclosure Flaw

CVE-2025-24089 Overview

CVE-2025-24089 is an information disclosure vulnerability affecting Apple iOS and iPadOS. The flaw stems from a permissions issue that allowed an application to enumerate the list of apps installed on a user's device. Apple addressed the issue by adding further permission restrictions in iOS 18.3 and iPadOS 18.3.

The weakness maps to [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). While the issue does not enable code execution or data modification, app inventory data can support device fingerprinting, targeted phishing, and reconnaissance for follow-on attacks.

Critical Impact
A malicious or curious app installed on an iOS or iPadOS device prior to version 18.3 may silently enumerate the user's installed apps without authorization, exposing sensitive profile information useful for targeted attacks.

Affected Products

Apple iOS versions prior to 18.3
Apple iPadOS versions prior to 18.3
Applications running on unpatched iOS/iPadOS devices

Discovery Timeline

2026-01-16 - CVE-2025-24089 published to NVD
2026-01-27 - Last updated in NVD database

Technical Details for CVE-2025-24089

Vulnerability Analysis

The vulnerability allows an app on iOS or iPadOS to enumerate other installed applications on the device. iOS is designed to restrict cross-app visibility through sandboxing and the LSApplicationQueriesSchemes mechanism, which requires apps to declare which URL schemes they will query. The defect bypassed those restrictions, letting a non-privileged app build a full or partial inventory of installed apps.

App inventory data is considered sensitive because it can reveal banking apps, healthcare apps, enterprise tools, dating apps, and other indicators of a user's identity, employer, or routine. Threat actors use this information for fingerprinting, profiling, and crafting convincing phishing lures.

The issue is classified as [CWE-200] Information Exposure. No user interaction is required beyond installing and running the malicious app, and the attack vector is local to the device through an installed application.

Root Cause

The root cause is improper permission enforcement on an API or system interface that returned app metadata. Apple's advisory states the issue was addressed with additional restrictions, indicating that the prior implementation failed to consistently apply access checks before disclosing installed app data to a calling process.

Attack Vector

Exploitation requires a malicious or compromised app to be installed on the target device. Once running, the app queries the affected interface and receives data identifying other installed applications. The result can be exfiltrated to an attacker-controlled server for profiling. There are no published proof-of-concept exploits, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

A technical exploitation example is not provided here because no verified public proof-of-concept exists. Refer to the Apple Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-24089

Indicators of Compromise

Mobile applications making unexpected calls to system APIs that return installed application metadata.
Outbound network traffic from a mobile app containing lists of bundle identifiers or app names shortly after first launch.
Apps requesting broad device profiling data without a legitimate functional reason disclosed in their privacy manifest.

Detection Strategies

Review App Store privacy nutrition labels and privacy manifests for declarations of device or app inventory collection.
For managed devices, use Mobile Device Management (MDM) reporting to identify installed iOS/iPadOS versions below 18.3.
Inspect enterprise app traffic with mobile threat defense tooling to flag exfiltration of app inventory payloads.

Monitoring Recommendations

Track the iOS and iPadOS build version distribution across the managed device fleet and alert on devices below 18.3.
Monitor app store submissions from internal developers for unauthorized use of installed-app enumeration techniques.
Correlate user-reported phishing attempts referencing specific installed apps with affected device cohorts to identify targeted reconnaissance.

How to Mitigate CVE-2025-24089

Immediate Actions Required

Update all iPhone and iPad devices to iOS 18.3 or iPadOS 18.3 or later, where Apple applied the additional permission restrictions.
Enforce minimum OS version compliance through MDM policies and quarantine non-compliant devices from sensitive corporate resources.
Audit installed third-party applications, especially on devices used by executives or privileged users, and remove unnecessary or untrusted apps.

Patch Information

Apple addressed the issue in iOS 18.3 and iPadOS 18.3 by adding further restrictions on the affected interface. Patch details and the full list of resolved CVEs are available in the Apple Security Advisory. Devices that support iOS 18 should be upgraded directly to 18.3 or a later version.

Workarounds

Install applications only from the official App Store and avoid sideloading from untrusted sources.
Restrict app installation on managed devices through MDM allowlists until the OS update is applied.
Review and remove apps with excessive permissions or unclear publishers from high-value user devices.

bash

# Verify iOS/iPadOS version meets the patched build
# On device: Settings > General > About > iOS Version (must be >= 18.3)
# Example MDM compliance query (Jamf Pro Smart Group criteria):
# Operating System Version  less than  18.3
# Action: Restrict access to corporate Wi-Fi and mail profiles