CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

SMS of Death PoC

tool · tool:sms-of-death-poc single-source

Public proof-of-concept Android app and source (Apache-2.0) that crafts the malformed WAP Push message and sends it as a data SMS to crash the com.android.phone process on a target phone, dropping calls including emergency calls (the researcher, who signs as Mark B, 2026-10-29).

Aliases: smsofdeath

Coverage
1
first 2026-11-02 → last 2026-11-02
Latest activity
2026-11-02
Android 'SMS of Death': one hidden SMS drops calls, emergency calls included; Android 12 and 13 get no fix
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about SMS of Death PoC, newest first. Check the date before acting on an older one.

Defender insights

What each entry about SMS of Death PoC tells a defender to do, newest first.

2026-11-02NOTABLEAndroid 'SMS of Death': one hidden SMS drops calls, emergency calls included; Android 12 and 13 get no fix

Exposure · triage · detection

Story timeline

  1. 2026-11-02Android telephony ('SMS of Death'): one hidden WAP Push message crashes the phone process and drops calls, emergency calls included; fixed for Android 14 to 17 in the October 2026 update according to the researcher, Android 12 and 13 stay exposed, public proof of concept
    trending-vulnerabilitiesAndroid 'SMS of Death': one hidden SMS drops calls, emergency calls included; Android 12 and 13 get no fix

Hunting pivots

Affected products
Google Android
Tags
dosmobilepatch-availablepoc-publicvulnerabilitieszero-click
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ImpactEndpoint Denial of Service: Application or System Exploitation

Impact TA0040

T1499.004Endpoint Denial of Service: Application or System Exploitation×1

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.

Evidence: 2026-11-02/android-sms-of-death-wap-push-telephony-crash · ATT&CK page ↗

Entries about SMS of Death PoC (1)

2026-11-02 · view entry permalink →

NOTABLENATOB2

Android telephony ('SMS of Death'): one hidden WAP Push message crashes the phone process and drops calls, emergency calls included; fixed for Android 14 to 17 in the October 2026 update according to the researcher, Android 12 and 13 stay exposed, public proof of concept

A researcher who signs as Mark B published a working proof-of-concept app on 2026-10-29 for a zero-click remote denial of service in Android's telephony framework (smsofdeath.com, 2026-10-29). One malformed WAP Push data message to port 2948 makes WapPushOverSms.decodeWapPdu() cast a 64-bit header length to a signed 32-bit integer and allocate a negative-sized array; the uncaught NegativeArraySizeException kills the com.android.phone process, which drops active calls, emergency calls included, and cuts service for one to two seconds per message (smsofdeath.com, 2026-10-29). The poison message stays in the pending queue and is retried on every boot and on carrier redelivery: the researcher reports that about 20 messages leave a device unusable and that one Android 12 phone rebooted into recovery roughly every 90 seconds until the messages were deleted over ADB (smsofdeath.com, 2026-10-29). The crash reproduced on Android 12 to 16, on a Pixel 9 and on Samsung Galaxy and A-series phones (smsofdeath.com, 2026-10-29); Security Affairs restates the mechanism and the October fix for Android 14 to 17 (Security Affairs, 2026-11-01).

Google's fix, titled "Fix remote DoS in decodeWapPdu", catches the exceptions the malformed messages trigger and deletes the malicious messages from the SMS database (BleepingComputer, 2026-10-31); per the researcher it shipped in the October 2026 update for Android 14 to 17, so Android 12 and 13 phones outside the update window run the same code unfixed (smsofdeath.com, 2026-10-29). BleepingComputer adds that the fix is not listed in Google's October bulletin (BleepingComputer, 2026-10-31). The proof-of-concept app and its source are public (smsofdeath.com, 2026-10-29; BleepingComputer, 2026-10-31), and none of the sources reports use in the wild.

Triage: a single telephony restart has many benign causes; a restart that recurs on every boot or on each carrier redelivery, with the exception above in the crash log, matches this flaw.

The message is delivered as a data SMS and is never shown to the user: there is nothing in the inbox, and the victim never sees the sender's number.

Devices updated to the October 2026 patch level or later are protected; devices on earlier patch levels remain vulnerable.

Mark B (smsofdeath.com) 2026-10-29

the flaw is not listed in Google's October security bulletin, and older Android 12 and 13 devices remain vulnerable because they did not receive the fix.

BleepingComputer 2026-10-31
vulnerability02 Nov 03:46Zsingle-sourceOpen finding →
Sources: Mark B (smsofdeath.com) · BleepingComputer · Security Affairs

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (33%)
  • securityaffairs.com1 (33%)
  • smsofdeath.com1 (33%)
All cited sources (3)