CVE-2025-24090: Apple iPadOS Information Disclosure Flaw

CVE-2025-24090 Overview

CVE-2025-24090 is an information disclosure vulnerability affecting Apple iOS and iPadOS. The flaw stems from insufficient permission restrictions that allow a locally installed application to enumerate the list of other applications installed on the device. Apple addressed the issue by adding additional restrictions to the affected component. The vulnerability is fixed in iOS 18.3 and iPadOS 18.3. It is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). No public exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A malicious app installed on a vulnerable device can enumerate the user's installed applications, enabling reconnaissance, targeted phishing, and fingerprinting of high-value users.

Affected Products

Apple iOS versions prior to 18.3
Apple iPadOS versions prior to 18.3
Third-party applications running on vulnerable iOS/iPadOS builds

Discovery Timeline

2026-01-16 - CVE-2025-24090 published to the National Vulnerability Database (NVD)
2026-01-27 - Last updated in NVD database

Technical Details for CVE-2025-24090

Vulnerability Analysis

The vulnerability is an information disclosure issue rooted in improper permission enforcement within iOS and iPadOS. Applications on iOS are sandboxed and are not supposed to determine which other apps are installed without explicit entitlements. CVE-2025-24090 breaks that boundary by allowing an app to enumerate installed bundle identifiers through an unrestricted code path. Apple's advisory describes the fix as adding additional permission restrictions to the affected component.

While this is not a code execution or privilege escalation issue, installed-app enumeration is a known reconnaissance primitive. Attackers use the list to fingerprint users, profile high-value targets, detect security tools, or craft tailored social engineering payloads referencing banking, enterprise, or messaging apps the victim uses.

Root Cause

The root cause is a missing permission check on an API or system interface that exposes installed application metadata. The affected code path returned data without verifying that the caller held the entitlement required to query the installed-apps registry. This aligns with CWE-200, where sensitive system state is made available to an actor that lacks authorization.

Attack Vector

Exploitation requires local access, meaning a malicious or compromised application already running on the device under low privileges. No user interaction is required beyond installing or launching the hostile app. The attacker queries the affected interface, receives the list of installed bundle identifiers, and exfiltrates the data to a remote server. The EPSS score is 0.005% (20th percentile), reflecting low observed exploitation activity.

No verified public proof-of-concept code is available. See the Apple Support Article for vendor-confirmed technical details.

Detection Methods for CVE-2025-24090

Indicators of Compromise

Unexpected outbound network connections from third-party apps shortly after install or launch
Mobile applications transmitting large lists of bundle identifiers (for example, com.apple.*, com.<vendor>.*) to attacker-controlled domains
App Store or sideloaded apps requesting unusual reconnaissance-style telemetry

Detection Strategies

Inventory iOS and iPadOS device versions through MDM and flag any device running a build older than 18.3
Review third-party app network traffic in mobile threat defense tooling for bulk enumeration payloads
Correlate targeted phishing campaigns that reference specific apps a user has installed, which can indicate prior enumeration

Monitoring Recommendations

Enforce continuous OS version compliance reporting through MDM dashboards
Monitor app reputation feeds for newly flagged apps abusing installed-app enumeration
Track DNS and TLS SNI telemetry from corporate-managed iOS devices for connections to known mobile C2 infrastructure

How to Mitigate CVE-2025-24090

Immediate Actions Required

Update all iPhone and iPad devices to iOS 18.3 or iPadOS 18.3 or later
Use MDM to enforce minimum OS version compliance and quarantine non-compliant devices
Audit installed third-party applications and remove apps from untrusted publishers

Patch Information

Apple released the fix in iOS 18.3 and iPadOS 18.3 by applying additional permission restrictions to the vulnerable component. Full details are documented in the Apple Support Article HT122066. Administrators should validate device patch levels using MDM compliance policies and Apple's published build identifiers.

Workarounds

Restrict installation of non-App Store applications via Apple Configurator or MDM restrictions
Limit user installation of low-reputation apps through managed App Store policies
Educate high-risk users about targeted phishing that may follow application fingerprinting

bash

# Example MDM compliance check for minimum iOS/iPadOS version
# Pseudocode for an MDM policy expression
require:
  platform: iOS, iPadOS
  minimum_os_version: "18.3"
action_if_noncompliant:
  - notify_user
  - block_corporate_resources
  - quarantine_device