A logic error in multiple functions of btm_sec.cc allows an attacker to intercept SMS messages. The flaw can lead to remote disclosure of sensitive information without requiring elevated execution privileges. User interaction is required for exploitation, meaning the victim must grant or enable a feature that permits the attacker to read SMS data.

The vulnerability affects Android devices provided by Google. Specific affected Android versions are not listed in the provided data, and no CPE strings are available.

The CVSS score is 4.3, indicating a low severity, and the EPSS score is below 1%, reflecting a very low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The attack likely stems from a local flaw that requires the user to interact with the system or accept a permission, so an attacker would need to trick the victim into enabling the interception path. Overall, the risk to information confidentiality is moderate but limited by the need for user involvement.