CVE-2025-24090
📋 TL;DR
This CVE describes an information disclosure vulnerability in iOS/iPadOS where malicious apps could enumerate which other apps are installed on a device. This affects users running iOS/iPadOS versions before 18.3.
💻 Affected Systems
- iOS
- iPadOS
📦 What is this software?
Ipados by Apple
⚠️ Risk & Real-World Impact
Worst Case
An attacker could profile a user's device, identifying installed apps to target for further attacks or gather personal information about user interests/habits.
Likely Case
Malicious apps could collect app installation data for advertising profiling or targeted phishing campaigns.
If Mitigated
With proper app sandboxing and App Store review, exploitation would be limited to apps that bypass Apple's security controls.
🎯 Exploit Status
Exploitation requires a malicious app to be installed on the target device with appropriate permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iOS 18.3 and iPadOS 18.3
Vendor Advisory: https://support.apple.com/en-us/122066
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Tap General. 3. Tap Software Update. 4. Download and install iOS 18.3/iPadOS 18.3. 5. Device will restart automatically.
🔧 Temporary Workarounds
Restrict App Installation Sources
allOnly install apps from trusted sources and avoid sideloading or enterprise app distribution unless necessary.
🧯 If You Can't Patch
- Implement Mobile Device Management (MDM) to control which apps can be installed on corporate devices.
- Educate users about only installing apps from the official App Store and reviewing app permissions carefully.
🔍 How to Verify
Check if Vulnerable:
Check iOS/iPadOS version in Settings > General > About > Software Version. If version is below 18.3, device is vulnerable.Check Version:
Not applicable for iOS/iPadOS - use Settings app interface.Verify Fix Applied:
After updating, verify Software Version shows 18.3 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual app permission requests for app enumeration APIs
- Suspicious app behavior logs in device management systems
Network Indicators:
- Unusual network traffic from apps sending device profiling data
SIEM Query:
Not typically applicable as this is a local device vulnerability requiring app installation.