Crafted WAP Push SMS can crash Android calls, including emergency
Original title: SMS of Death: Android under attack, an invisible SMS can block calls and emergency services
A five-byte WAP Push kills com.android.phone; Google patched Android 14–17 in October 2026, while 12 and 13 may stay exposed.
Independent researcher Mark Blaszczyk showed that a hidden WAP Push data SMS can crash Android’s com.android.phone process without user interaction. A uintvar length in decodeWapPdu() is cast to a 32-bit integer without a range check, producing a negative array size and an uncaught exception. Each crash lasts about one to two seconds, but queued or retransmitted messages can extend the outage, and roughly twenty messages can leave a phone unusable or stuck crashing at boot. Google shipped a fix in the October 2026 security update for Android 14, 15, 16, and 17; Android 12 and 13 may remain vulnerable.
Unconfirmed: No CVE is named, and the article does not confirm attacks beyond the researcher’s tests; the Android 12 and 13 fix status is cut off.
- The trigger is a five-byte WSP header sent as data SMS on port 2948.
- The message is not shown in the inbox and needs no tap.
- Tests covered Google Pixel 9 and Samsung Galaxy and Galaxy A phones.
- Vulnerable code is described as present from Android 12 through Android 17.
- Persistent crashes may require clearing the SMS queue with ADB.
Impact: Crashes telephony, blocking voice calls including emergency
| Product | Affected | Fixed in |
|---|---|---|
| Google Android | Android 14, 15, 16, and 17 | October 2026 security update |
| Google Android | Android 12 and 13 | — |
- 1.Install the October 2026 Android security update on versions 14, 15, 16, and 17.
- 2.Check the security patch level on devices that no longer receive vendor updates.
From the original article
5 min read at securityaffairs.comSMS of Death lets attackers crash Android call services with a hidden, zero-click message, blocking phone calls, even emergency calls too. A specially manipulated SMS message is enough to crash Android’s phone service, interrupt ongoing calls, and temporarily render the smartphone unusable. The attack requires no interaction from the victim and can even compromise the […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.