DesktopSMS CVE-2026-94540

Exploitation requires the attacker to already have code execution on the SAME device as the victim (e.g., a co-installed malicious Android app or ADB/loopback access) - this is a local attack (AV:L), not remotely reachable. The vulnerable component is DesktopSMS's exposed local/loopback service, which performs privileged SMS operations without any pairing confirmation, authentication, or user interaction (CWE-306, PR:N/UI:N). AT:P indicates a specific precondition on the service/pairing state must hold. What LIMITS exploitation: no network vector, so a device foothold is mandatory; impact is scoped to the victim app's own SMS permissions; affected only on DesktopSMS 1.11.0 (MrPear). No non-default configuration is needed once an attacker is on-device.

Real-world risk is moderate and highly context-gated. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H) confirms LOCAL attack vector - this is NOT remotely exploitable over a network; an attacker must already have code execution on the same device (a malicious co-installed app, or ADB/loopback access). PR:N confirms no authentication is required against the exposed local service, and VC:H/VI:H reflect genuine high confidentiality (reading SMS-derived content, including potential 2FA/OTP codes) and integrity (sending SMS as the victim, hijacking the paired identity) impact. AT:P signals a specific attack requirement/precondition must be met (consistent with the pairing/service-state interaction described), slightly tempering ease of exploitation. Publicly available POC code raises practical risk. However, there is NO CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - exploitation status is limited to 'publicly available exploit code exists.' The 7.4 score is credible for the local impact but the local-only vector and same-device prerequisite substantially limit real-world blast radius compared to a network-facing 7.4. Net: a legitimate concern for at-risk mobile devices but not an emergency-patch, mass-exploitation scenario. No patched version is identified in the provided data - verify remediation with the vendor.

A malicious or compromised app installed on the same Android device (or an attacker with ADB/loopback access) connects to DesktopSMS's unauthenticated local service and, without any pairing confirmation or user interaction, instructs it to send SMS messages and read SMS-derived content using the victim app's granted SMS permissions. Public POC exploit code exists (actuator/net.mrpear.apps.desktopsmslite), lowering the barrier to reproduction. Because the vector is local (AV:L) with an attack precondition (AT:P), the attacker must already have a foothold on the device.