www.it-connect.fr
Android’s “SMS of Death” Bug Can Drop Calls with an Invisible WAP Push
An invisible SMS, with no notification and no sender number, can make your Android smartphone hang up, even during an emergency call. That is the idea behind the attack nicknamed SMS of Death, linked to a flaw disclosed on October 29, 2026 by an independent researcher. Here’s what you need to know.
Researcher Mark Blaszczyk published his findings on smsofdeath.com, nearly six months after reporting the issue to Google, with the disclosure dating back to May 5, 2026.
The SMS of Death attack relies on a vector that is not new: WAP Push messages. Unlike a standard text SMS, a WAP Push is a binary SMS sent to an application port (here, port 2948), much like a network packet aimed at a specific service. This is the channel operators use, for example, to send MMS notifications or configuration settings (APN). These messages never appear in the Messages app: they are processed in the background by Android’s telephony framework. Back in 2009, oCERT had already reported that a malformed WAP Push message could disconnect an Android 1.5 smartphone from the mobile network. More than 15 years later, history repeats itself...
Indeed, this attack was reproduced on a Google Pixel 9 smartphone (April 2026 firmware) and on several Samsung Galaxy devices, with a 100% success rate according to the researcher, from Android 12 through Android 16.
A Bad Integer Conversion Brings Telephony Down
The security issue lies in the decodeWapPdu() method in the WapPushOverSms component, which is responsible for decoding WAP Push messages. Each message begins by announcing the size of its header, and Android trusts this value without checking it. During testing, the researcher injected an enormous number: 2 147 483 648 (the sequence 88 80 80 80 00, or 0x80000000). However, Android stored this number in a variable that cannot exceed 2 147 483 647 (a signed 32-bit integer). This one-unit overflow is enough to flip the value into a negative one: it becomes -2 147 483 648.
What happens next? Android tries to allocate a memory block of that size to read the header. But a negative size makes no sense, so the system triggers an error that the code was not designed to handle. Result: the com.android.phone process, which handles the smartphone’s entire telephony stack, crashes.
According to Mark Blaszczyk, this has several consequences for the targeted device:
- No visible interaction: nothing appears on screen and the attacker’s number remains hidden. Knowing the target’s number is enough.
- Calls dropped: each crash interrupts telephony service for 1 to 2 seconds on the targeted smartphone, ending ongoing calls, including those to emergency services.
- Prolonged effect: the carrier resends unacknowledged messages. During testing, a single SMS caused intermittent outages for a week (each time it was resent).
- Crash loop: with around twenty messages, the device becomes unusable because the trapped messages are processed again at every boot. On Android 12, the phone returns to recovery mode about every 90 seconds, with a data wipe option shown on screen.
An average user will therefore end up resetting the phone. However, a procedure documented by a project contributor makes it possible to remove only the affected messages from the content://sms/raw table via ADB. You still need a computer and know how to use ADB...
A PoC app (APK format) and its source code are available on GitHub. "This is a functional weapon", the researcher warns.
A Quiet Patch, Without a CVE
According to the timeline originally published by the researcher, Google had considered this issue to be outside the scope of security, and that was still Google’s position at the end of October 2026. Yet an Android engineer wrote a fix as early as June 15, 2026: the commit 735d967, titled "Fix remote DoS in decodeWapPdu". According to Mark Blaszczyk, Google included this fix in the October 2026 Android security update, for Android 14 to 17.
I get the impression that there is no mention of this fix in the October 2026 Android security bulletin, and no CVE identifier has been assigned to this flaw. Yet the commit carries the CVE_FIX label.
As for the technical side of the fix, the researcher had proposed that Google add a length-checking mechanism, but Google chose a different approach. The fix in question more broadly catches exceptions and removes the "trapped" message from the message database, which eliminates the crash-loop risk. The bug’s root cause is still not fixed: Android still converts the announced size without verifying it, but the error is now handled correctly.
To protect yourself from this flaw, there is only one thing to check: install the October 2026 security patches on your Android smartphone. Of course, they still need to be available.
