osky

"SMS of Death": an invisible message can take down Android's telephony and hang up emergency calls

Sección
Technology

A single invisible SMS can knock out an Android phone's telephony service and drop any call in progress, including emergency calls. That's what "SMS of Death" describes, the flaw researcher Mark Blaszczyk made public on October 29 along with a working proof of concept. Google has already written a patch, but classified the issue as "non-security," and there are conflicting accounts about which update it ships in. If you have an Android phone, the only thing that matters is your security patch level.

What breaks and why it's so easy

The bug lives in WapPushOverSms, the component of Android's telephony framework that processes WAP Push messages, an old data-SMS format that carriers still use for MMS notifications and configuration.

According to the report, when decoding the message Android reads the header length as a 64-bit number and converts it to a 32-bit integer without checking the range. With the right value, that number goes negative, Android tries to create an array of negative size and throws a NegativeArraySizeException that nobody catches. The result: com.android.phone dies, the process that handles calls and the cellular network.

What makes it nasty, again according to the researcher:

  • Zero clicks. The victim doesn't have to open anything; the attacker just needs their number.
  • Silent. The message arrives as a data SMS on the WAP Push port, doesn't show up in the Messages app and doesn't display the sender's number.
  • Cuts calls. Each message leaves the phone without service for a second or two while the process restarts, and the active call drops.
  • Repeats on its own. Since the phone crashes before confirming it received the message, the carrier resends it. In his tests, a single message caused intermittent outages for up to a week, and about 20 left the device unusable for quite a while.
  • Survives a reboot. The message stays in the pending SMS queue and gets reprocessed on every startup. The researcher describes a loop in which Android sends the device into recovery mode every 90 seconds, one step away from the user choosing to wipe everything.

Blaszczyk says he reproduced it 100% of the time on a Pixel 9 with April 2026 firmware and on several Samsung Galaxy phones, including the A series. Getting out of the loop without a factory reset requires a computer and ADB to delete the poisoned messages; another user documented the procedure in the project's repository.

Diagrama del ciclo de SMS of Death: el WAP Push malformado llega sin verse, WapPushOverSms convierte la longitud de 64 a 32 bits sin validar, se lanza NegativeArraySizeException, muere com.android.phone y el mensaje se reprocesa hasta que el parche de Google lo borra de la cola

Google: "not a security issue," but they did patch it

Blaszczyk reported it on May 5 through Android's bounty program. According to CyberInsider and Cyber Kendra, Google closed it as "won't fix," flagged it as a duplicate and on October 29 reaffirmed that it "doesn't meet the severity threshold." No CVE has been assigned.

Meanwhile, the code tells a different story. In AOSP there's a commit from a Google engineer, dated June 15, titled literally "Fix remote DoS in decodeWapPdu" and tagged CVE_FIX. It doesn't add the range validation the researcher proposed: it catches any RuntimeException during decoding and deletes the problematic message from the pending SMS table, which is what breaks the restart loop.

Am I protected yet? Here's where it gets tangled

  • The researcher's page says the fix shipped in the October 2026 security update.
  • But the October Android security bulletin (published on the 5th and updated on October 8) doesn't mention that commit or the WAP Push component.
  • A GrapheneOS team member wrote in the project's issue tracker that the patch circulated among manufacturers in the mid-July preview patches, that GrapheneOS has had it since then, and that it's part of the November 2026 bulletin.

My take: don't count on October. Check your patch level under Settings > Security and consider yourself covered when it says 2026-11-01 or later (or if you run GrapheneOS). On Samsung and other brands that can take weeks, because it depends on each manufacturer and sometimes on each carrier.

How bad is it in real life

There's a legitimate debate here. On Hacker News several people question whether carriers let a malformed WAP Push sent from just any phone through; others reply that the proof of concept does exactly that from an app and that, even if some networks filter it, an IMSI catcher skips any carrier filter. The proof of concept is public, under the Apache 2.0 license, and works from any Android 11 or later device with a SIM. The researcher reports no active exploitation.

What this means, in my opinion: a system process crashing because of a message nobody asked for, and then getting stuck in a loop on top of that, is a security flaw even if Google files it in a different drawer. For anyone who depends on their phone at an event or in a booth, a phone that hangs itself is more than an annoyance, and in Mexico the underlying risk is the same: not being able to dial 911. If you run bots or systems that send SMS, this doesn't affect you directly, but your Android users who haven't updated are exactly the most exposed.

Sources