Android telephony ('SMS of Death'): one hidden WAP Push message crashes the phone process and drops calls, emergency calls included; fixed for Android 14 to 17 in the October 2026 update according to the researcher, Android 12 and 13 stay exposed, public proof of concept
Android 'SMS of Death': one hidden SMS drops calls, emergency calls included; Android 12 and 13 get no fix
Defender actions
- Install the October 2026 Android security update on every managed Android phone below that patch level, phones of emergency-service and on-call staff first.
Analysis
A researcher who signs as Mark B published a working proof-of-concept app on 2026-10-29 for a zero-click remote denial of service in Android's telephony framework (smsofdeath.com, 2026-10-29). One malformed WAP Push data message to port 2948 makes WapPushOverSms.decodeWapPdu() cast a 64-bit header length to a signed 32-bit integer and allocate a negative-sized array; the uncaught NegativeArraySizeException kills the com.android.phone process, which drops active calls, emergency calls included, and cuts service for one to two seconds per message (smsofdeath.com, 2026-10-29). The poison message stays in the pending queue and is retried on every boot and on carrier redelivery: the researcher reports that about 20 messages leave a device unusable and that one Android 12 phone rebooted into recovery roughly every 90 seconds until the messages were deleted over ADB (smsofdeath.com, 2026-10-29). The crash reproduced on Android 12 to 16, on a Pixel 9 and on Samsung Galaxy and A-series phones (smsofdeath.com, 2026-10-29); Security Affairs restates the mechanism and the October fix for Android 14 to 17 (Security Affairs, 2026-11-01).
Google's fix, titled "Fix remote DoS in decodeWapPdu", catches the exceptions the malformed messages trigger and deletes the malicious messages from the SMS database (BleepingComputer, 2026-10-31); per the researcher it shipped in the October 2026 update for Android 14 to 17, so Android 12 and 13 phones outside the update window run the same code unfixed (smsofdeath.com, 2026-10-29). BleepingComputer adds that the fix is not listed in Google's October bulletin (BleepingComputer, 2026-10-31). The proof-of-concept app and its source are public (smsofdeath.com, 2026-10-29; BleepingComputer, 2026-10-31), and none of the sources reports use in the wild.
Triage: a single telephony restart has many benign causes; a restart that recurs on every boot or on each carrier redelivery, with the exception above in the crash log, matches this flaw.
Cited evidence
The message is delivered as a data SMS and is never shown to the user: there is nothing in the inbox, and the victim never sees the sender's number.
Devices updated to the October 2026 patch level or later are protected; devices on earlier patch levels remain vulnerable.
the flaw is not listed in Google's October security bulletin, and older Android 12 and 13 devices remain vulnerable because they did not receive the fix.
Sources3
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.