🚨 SMS of Death: A Zero-Click Android Flaw That Can Disrupt Calls

“SMS of Death” is the name used by researcher Mark Blaszczyk for a zero-click Android telephony denial-of-service issue. A specially malformed WAP Push data SMS can trigger a failure in Android’s WAP Push parser, causing the com.android.phone process to terminate. Affected users may lose cellular service temporarily, have an active call disconnected, or experience repeated failures if the message remains queued for redelivery.

This is a service-availability vulnerability, not a demonstrated remote-code-execution or data-theft flaw. Public reporting describes possible disruption to emergency calls because the affected process handles telephony. Impact depends on device software, carrier behaviour, and message redelivery.

The reported component is WapPushOverSms.decodeWapPdu() in Android’s frameworks/opt/telephony code. WAP Push is a special SMS-delivered data mechanism processed automatically; it is not necessarily displayed like an ordinary text message.

The researcher describes a length-parsing problem: a Wireless Session Protocol header length is decoded as a variable-length unsigned value, then converted to a signed integer without sufficient range validation. An oversized value can become negative. Using that value for an array allocation can throw NegativeArraySizeException, terminating com.android.phone.

Because parsing occurs automatically on receipt, the victim does not need to open a message, tap a link, or install an application. This is why the issue is described as zero-click.

Classification: remote, zero-click denial of service against Android telephony. It is not evidence of spyware installation, arbitrary code execution, or direct access to personal files.

• A single malformed message may cause a short telephony interruption and disconnect an ongoing call.
• If the network or device retries delivery because the message was not acknowledged, repeated parser failures may extend the outage.
• Repeated messages may create persistent disruption. The researcher reports tests where queued messages caused repeated crashes after reboot.
• Emergency calls could be affected while the telephony process is unavailable; this is a service-availability consequence.

The public disclosure describes denial of service. It does not demonstrate access to contacts, messages, passwords, photos, location history, or other stored personal data. Do not describe it as a data-exfiltration vulnerability.

The primary asset at risk is telephony availability: voice calls, mobile connectivity, and potentially emergency calling during an interruption. Secondary consequences include missed calls and interrupted business operations.

The public disclosure identifies independent researcher Mark Blaszczyk. The researcher says the issue was submitted through Google’s Android and Devices Vulnerability Reward Program on 5 May 2026, with a suggested bounds-check fix supplied at that time.

The researcher’s timeline says Google ultimately classified the report as a Non-Security Issue / Won’t Fix on 29 October 2026. This is the researcher’s account of vendor handling. No criminal threat actor or exploitation campaign is identified in the public reporting reviewed here.

The researcher is not an attacker. Publication of a proof of concept is not evidence of exploitation in the wild.

1. 5 May 2026: researcher says the issue was reported through Google’s Android & Devices VRP.
2. 15 May 2026: researcher says the behaviour had been reproduced on several handsets and call interruption was raised.
3. 20–23 June 2026: follow-up appeals and additional impact details were submitted, including repeated crashes from queued messages.
4. July 2026: further review and discussion are recorded in the researcher’s disclosure timeline.
5. 27 October 2026: researcher says a further status request was made.
6. 29 October 2026: researcher published the full disclosure after reporting Google’s final Won’t Fix / Non-Security Issue decision.
7. 30 October 2026: GBHackers and other outlets published summaries.

GBHackers’ 30 October article says fixes shipped in the October 2026 security update for Android 14 through 17 and advises installing the manufacturer’s October update or later. However, the researcher’s disclosure site says Google declined to fix this specific report. The official October Android Security Bulletin lists several remote DoS issues, but its public entries do not by themselves establish that this exact WAP Push issue is included.

Because these claims conflict, do not assume every device is protected solely because it displays an October 2026 patch level. Check the device manufacturer’s release notes or obtain confirmation that this specific WAP Push parser issue is addressed. Keep the device fully updated regardless.

• Install the latest Android security and manufacturer firmware updates for the exact device model. Check vendor notes for confirmation of this issue.
• Avoid APKs or tools claiming to protect against the flaw unless supplied by a trusted vendor; ordinary apps may not prevent a telephony-framework parser failure.
• If the phone repeatedly loses cellular service or reboots after messages, contact the manufacturer and carrier using another phone.
• For persistent failure, seek manufacturer or qualified mobile-forensics support. Avoid factory resets or manual database changes before considering evidence and data recovery.
• Carriers and device vendors should assess WAP Push handling, redelivery behaviour, and queue-management mitigations.
• If emergency calling is unavailable on the affected handset, use another working phone or available alternative emergency contact method.

SMS of Death highlights how automatically processed telecom data can create a remote availability risk without a user click. Distinguish service disruption from data theft, verify device-specific patch status, and ensure users have another way to reach emergency services.

CyberRakshakLabs — Research | Awareness | Safer Digital India. https://cyberrakshaklabs.in/research/

• GBHackers, 30 October 2026: https://gbhackers.com/new-zero-click-android-vulnerability/
• Researcher disclosure, “SMS of Death: zero-click Android telephony DoS”: https://smsofdeath.com/
• Cyber Security News, 29 October 2026: https://cybersecuritynews.com/zero-click-android-vulnerability/
• Android Security Bulletin—October 2026 (patch-level context; does not independently identify this exact issue): https://source.android.com/docs/security/bulletin/2026/2026-10-01
• USENIX Security 2011, historical SMS-triggered mobile availability research, involving different platforms: https://www.usenix.org/conference/usenix-security-11/sms-death-analyzing-attacking-mobile-phones-large-scale