Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Malformed WAP Push SMS can crash Android phone process; fix status disputed

3 sources · 3 articlesFirst reported Updated ()1
What's new

October 30: GBHackers reports an October 2026 Android 14–17 update that catches the exception and removes the message, conflicting with earlier Won’t Fix accounts.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A zero-click WAP Push SMS can kill Android’s phone app and drop calls; outlets disagree on whether Google has fixed it.

Independent researcher Mark Blaszczyk disclosed on October 29, 2026, after a 90-day window, that a malformed WAP Push data SMS can crash com.android.phone without user interaction. An unchecked conversion in WapPushOverSms.decodeWapPdu() throws NegativeArraySizeException, ending active calls, including emergency calls; the message does not appear in the inbox. Tests on a Pixel 9 with April 2026 firmware and Samsung Galaxy phones reproduced the crash. About 30 rapid messages can corrupt the SMS SQLite store so the process crashes on every boot, and carrier redelivery of one unacknowledged SMS caused repeated outages for up to a week, according to the disclosure. Lobsters and Cyber Security News say Google’s Android VRP marked the report non-security and Won’t Fix, with no CVE. GBHackers instead reports that the October 2026 update for Android 14 through 17 catches the failure and removes the triggering message.

Key facts
  • Unchecked cast in WapPushOverSms.decodeWapPdu() throws NegativeArraySizeException.
  • Reached through SMS port 2948; payload never appears in the inbox.
  • About 30 rapid messages can corrupt the SMS SQLite database.
  • Carrier retry of one unacknowledged SMS repeated crashes for up to a week.
  • Google VRP marked it non-security and Won’t Fix; no CVE was issued.
  • GBHackers says October 2026 updates for Android 14–17 catch the crash.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. May 5, 2026Researcher reported the WAP Push crash to Google. · Lobsters
  2. Oct 29, 2026Mark Blaszczyk disclosed the bug after 90 days. · Lobsters
  3. Oct 1, 2026GBHackers says Android 14–17 update ships a fix. · GBHackers

What each outlet adds

beyond the shared facts
  • LobstersMay 5 report date, no CVE, SIM and ADB recovery.
  • Cyber Security NewsApril 2026 Pixel firmware and one-to-two-second service gaps.
  • GBHackersClaims October 2026 Android 14–17 update catches the crash.
Vendors
GoogleSamsung
Products
AndroidPixel 9
Organizations
ACMATelstra
Countries
Australia

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Lobsters · securityFirst report

    Malformed WAP Push SMS crashes Android telephony, dropping calls

    Google's Android VRP marked the zero-click bug non-security and will not fix it; no CVE was issued.

  2. · 1d ago Cyber Security News

    Malformed WAP Push text can crash Android phone service

    Repeated messages can corrupt the SMS database so the phone app crashes on every boot, and Google marked it Won’t Fix.

  3. · 19h ago GBHackers

    Zero-click Android SMS flaw can crash phones and drop calls

    The disclosure describes denial of service, not code execution, and queued messages can crash the phone again after reboot.