Malformed WAP Push SMS crashes Android telephony, dropping calls
Original title: A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls)
Google's Android VRP marked the zero-click bug non-security and will not fix it; no CVE was issued.
A malformed WAP Push data SMS triggers an unchecked cast in WapPushOverSms.decodeWapPdu(), throwing NegativeArraySizeException and killing com.android.phone. Active calls end, including emergency calls, and the message never appears in the inbox. Rapid delivery can corrupt the SMS SQLite store so the process crashes on every boot. Independent reporter Mark Blaszczyk disclosed it on October 29 after a 90-day window; testing covered Pixel 9 and Samsung Galaxy devices.
Unconfirmed: In-the-wild attacks are not reported; outage length and full reproduction come from the reporter's testing, and the vendor classifies it as non-security.
- A 5-byte uintvar of 0x80000000 becomes array size -2147483648.
- Carrier redelivery of unacknowledged SMS repeated crashes for up to a week in testing.
- About 30 rapid messages can corrupt the SMS database.
- Reported May 5 2026 and disclosed October 29 2026.
- Recovery can require moving the SIM and clearing the database over ADB.
Impact: Zero-click remote denial of telephony, including emergency calls
| Product | Affected |
|---|---|
| Google Android | — |
- 1.Move the SIM to a non-Android phone so the carrier stops redelivering the SMS.
- 2.Clear the corrupt SMS database over ADB after stopping redelivery.
From the original article
7 min read at smsofdeath.comA single malformed WAP Push SMS crashes com. android. phone on Android, dropping active calls ( including emergency calls ), with zero interaction from the victim.
By smsofdeath.com via benjoffe · smsofdeath.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.