An Android telephony flaw dubbed “SMS of Death” can silently crash a phone’s calling service after it receives a malformed WAP Push message, dropping active calls without the recipient opening a message or tapping anything. Independent researcher Mark Blaszczyk disclosed the issue on October 29 and said the crash can also interrupt emergency calls while the affected system process restarts.
The attack uses a data SMS that is processed by Android’s WAP Push handler. The message does not appear in the recipient’s inbox, and the user is not shown the sender’s number. In his technical disclosure, Blaszczyk traced the problem to the WapPushOverSms.decodeWapPdu() function, which converts a message header length from a long value to an integer without first checking whether it falls within a valid range. A specially crafted value can become a negative array size and trigger an uncaught exception in the phone process.
Blaszczyk says a single malformed message caused repeated service interruptions in his testing because carriers may resend messages that the phone has not acknowledged. He also reported that a burst of around 20 messages could leave the malformed message queued and make the device unusable for an extended period, with the telephony process crashing again during startup. Recovering from a persistent loop may require a computer and Android Debug Bridge rather than a normal restart. The researcher said he reproduced the issue on a Pixel 9 and several Samsung Galaxy devices, but did not report confirmed exploitation in real-world attacks.
Google’s Android Open Source Project contains a June 15 change titled “Fix remote DoS in decodeWapPdu.” The commit adds exception handling around WAP Push processing and removes a message that triggers a runtime failure from the raw SMS database, preventing it from repeatedly crashing the phone during redelivery or startup. Blaszczyk says the change shipped in the October 2026 Android security update for Android 14 through Android 17, while devices on older Android 12 and 13 releases may not receive the same protection.
Blaszczyk said he first reported the issue to Google’s Android and Devices Vulnerability Reward Program on May 5. Google’s AOSP change is explicitly described as a fix for remote denial of service, although no CVE identifier appears in the public disclosure. The researcher published a proof-of-concept intended only for devices that testers own or are authorized to assess.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
