DesktopSMS 1.11.0 allows a local attacker to interact with the application’s local service without authentication, enabling the attacker's transmission of SMS messages, retrieval of SMS-derived content, and persistence of a chosen paired identity. The vulnerability is exploited via the same‑device loopback interface, allowing the attacker to perform privileged SMS operations with the victim application's permissions, potentially leaking sensitive information or enabling further attacks through SMS channels.

The affected product is MrPear:DesktopSMS version 1.11.0. No other versions are listed as impacted.

The CVSS score of 7.4 signals a high severity risk for local users. Although the EPSS score is not available, the vulnerability can be exploited by anyone with local access or a malicious local process. The absence from the CISA KEV catalog indicates no current widespread exploitation, but the capability remains dangerous due to the privileged SMS functions and lack of user interaction. The risk is substantial for systems that rely on DesktopSMS for secure messaging, especially if the application runs with elevated rights.