Zero-click Android SMS flaw can crash phones and drop calls
Original title: New Zero-Click Android Vulnerability Lets Attackers Crash Phones With a Single SMS
The disclosure describes denial of service, not code execution, and queued messages can crash the phone again after reboot.
Researcher Mark B disclosed on October 29 that one malformed WAP Push SMS can crash Android’s telephony process without user interaction. The parser casts an unbounded header length to a signed 32-bit integer, allocates a negative-size array, and kills com.android.phone, which can drop calls. Google’s October 2026 security update for Android 14 through 17 catches the failure and removes the triggering message. Tests on a Pixel 9 and Samsung Galaxy phones showed repeated crashes.
Unconfirmed: Outage length reflects the researcher’s tests, not results across all Android handsets.
- The bug is in WapPushOverSms.decodeWapPdu(), reached through SMS port 2948.
- An oversized header length becomes a negative int and throws NegativeArraySizeException.
- Fixes shipped in the October 2026 update for Android 14 through 17.
- In researcher tests, one message caused outages lasting up to a week.
- Malicious WAP Push payloads do not appear in the messaging inbox.
Impact: Crashes telephony and can disconnect active calls
| Product | Affected | Fixed in |
|---|---|---|
| Google Android | Android 14 through 17 | October 2026 security update |
- 1.Install the manufacturer’s October 2026 security update or a later release.
- 2.Limit the published proof of concept to explicitly authorized testing.
From the original article
2 min read at gbhackers.com
A recently discovered Android vulnerability, referred to as SMS of Death, allows attackers to crash a phone’s telephony process with just one malformed SMS, without any interaction from the victim. Researcher Mark B reports that this flaw can disconnect active calls, including emergency calls, and leads to persistent service disruptions when malicious messages remain in […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.