The vulnerability is a classic path traversal flaw in the HarmonyOS SMS application, classified as CWE-22. It allows an attacker to manipulate file paths supplied to the app, potentially accessing files outside the intended directory structure. The provided description states that exploitation may affect availability, suggesting that an attacker could cause the SMS app to crash, become unresponsive, or lock the device, thereby denying legitimate users the ability to send or receive messages.

The affected system is the SMS application on Huawei HarmonyOS devices. No specific version or patch level is listed, so all installations of the HarmonyOS SMS app could be vulnerable until a fix is applied.

The CVSS score is 5.4, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalogue, implying no current evidence of exploitation in the wild. The attack vector is not explicitly stated in the available data, so it is inferred that exploitation would require either local access to the device or a privileged user interaction with the SMS app. Given the lack of known exploits and the availability impact, the overall risk remains moderate but warrants proactive monitoring.