Analysis
A silent SMS can crash Android's phone process: what is known about the SMS of Death
A denial-of-service flaw, not a code-execution one: what a researcher reports about a silent SMS crashing Android, and what Google's code shows.
As of November 1, 2026, the "SMS of Death" is described by its discoverer as a zero-click denial of service: a silent data SMS crashes Android's phone process and calls drop. No code execution or data theft is reported. A fix exists in Android's code, but sources disagree on its rollout, and we found no manufacturer statement.
The essentials
- What it is: a zero-click denial of service through a WAP Push data SMS, with no notification, according to the researcher.
- The impact, per the researcher: dropped calls, carrier resends, sometimes a crash loop.
- The fix: a Google commit dated June 15, 2026 exists, but the report was reportedly classed non-security, with no CVE.
- What is uncertain: the rollout state differs between sources, and we found no manufacturer statement.
How can an SMS crash the phone?
According to the researcher, Mark Blaszczyk (named by Cyber Kendra), the bug sits in WapPushOverSms, part of Android's telephony framework. The decodeWapPdu() function reads a WSP header length as a variable-length integer (a long) and converts it to a 32-bit int without a range check. A value encoded on five bytes becomes -2,147,483,648. Allocating an array of that size throws a NegativeArraySizeException that nothing catches, which kills the com.android.phone process. We do not reproduce the payload.
"Zero-click" means that the phone number is enough. The data SMS goes to the WAP Push port: no notification, it never reaches the Messages app, and the sender is not shown.
The chain below is the researcher's account.
Source: smsofdeath.com, Cyber Kendra (October 2026). According to the researcher; not reproduced by us.
What is the impact, and who is affected?
All figures below are the researcher's, unverified. Each message cuts cellular service for 1 to 2 seconds, and a call in progress, emergency calls included, ends. The phone crashes before acknowledging the message, so the carrier resends it. In the researcher's tests, a single message caused intermittent cuts for up to a week and about 20 made a device unusable for long. About 30 messages in quick succession can corrupt the SMS SQLite database, after which the process crashes at every start. A factory reset does not break the cycle, since the carrier resends pending payloads.
He describes a recovery reserved for advanced users, which we do not detail, and says an eSIM would make it much harder.
He reports reproduction every time on a Pixel 9 (April 2026 firmware) and several Samsung Galaxy and A-series phones. The researcher's page lists Android 12 to 17 for the affected code. Per Cyber Kendra, the proof of concept is public on GitHub (Apache 2.0); we do not link it. Cyber Security News adds that Android 17's protections against 2G fallback and "SMS blasters" do not seem to cover it. No source reports code execution, data theft or exploitation in the wild.
What has been fixed?
The sequence below combines the researcher, Cyber Kendra and the Android source.
Source: AOSP, Android security bulletin of October 2026, Cyber Kendra, smsofdeath.com. Rollout dates are disputed between sources.
The researcher reported the bug on May 5 to Google's reward program and says he supplied a bounds-check fix that day. On June 20 the case was closed as Won't Fix (Infeasible), and an appeal was closed in three minutes as not reproducible, per Cyber Kendra. On October 29, after three months of silence, Google decided the bug "does not meet the severity threshold" (Cyber Kendra), a non-security classification with no CVE. The researcher then published the details. Cyber Kendra notes that Google treated a near-identical WAP Push bug as a security flaw in 2009 (CVE-2009-2999).
The code tells a different story. AOSP commit 735d967 (platform/frameworks/opt/telephony) ("Fix remote DoS in decodeWapPdu"), by Thomas Nguyen, was written June 15, 2026 and committed to that branch August 5. It catches a RuntimeException during WAP Push decoding and dispatch, logs a warning and drops the message instead of crashing. It is not the researcher's bounds check. It is labeled as exempt, with a CVE_FIX flag.
The October 2026 Android security bulletin, published October 5 (patch level 2026-10-01), has no entry mentioning SMS, MMS, PduParser or WAP Push. That does not mean the fix is absent.
On rollout, the researcher's page says the fix shipped in the October 2026 update for Android 14 to 17 and that Android 12 and 13, out of their update window, will not get it. We could not verify this. Cyber Kendra instead places the fix in the November 2026 bulletin, which was not available (404) on November 1.
What should you do?
Install security updates (October 2026 or newer) as soon as your manufacturer offers them, as the sources advise. Do not try to reproduce the flaw. If your phone crashes in a loop, contact the manufacturer or carrier. No update guarantees immunity.
Comparison table
| Point | What sources say as of Nov 1, 2026 | Source |
|---|---|---|
| Nature of the flaw | Denial of service; no code execution or data theft reported | smsofdeath.com, Cyber Kendra |
| Devices tested | Pixel 9 and several Samsung Galaxy and A-series phones | smsofdeath.com |
| Google's response | Below severity threshold; non-security; no CVE | Cyber Kendra |
| Fix in the code | Commit 735d967, written June 15, 2026 | AOSP |
| October 2026 bulletin | No SMS or WAP Push entry | Android bulletin |
| Android 12 and 13 | No fix, out of update window, per the researcher | smsofdeath.com |
Frequently asked questions
Can my phone be hacked through this SMS?
Not according to the disclosure: it is a denial of service, with no code execution, data theft or exploitation in the wild reported.
Am I protected?
The researcher says a fix shipped in the October 2026 update for Android 14 to 17, which we could not verify independently. Install the latest update. By his account, Android 12 and 13 are not covered.
Why is there no CVE?
Per Cyber Kendra, Google classed the bug as non-security. The commit nevertheless carries a CVE_FIX flag. We do not settle that.
Method and limits
We read all five sources below on November 1, 2026 and did not reproduce the flaw. Impact details and tested models are the researcher's, unverified. We found no statement from Google (beyond the commit) or any manufacturer. The November bulletin was unavailable, and sources disagree on the rollout.
Sources
- smsofdeath.com: researcher's page (verified 2026-11-01)
- Cyber Kendra: SMS of Death, Android WAP Push zero-click, October 2026 (verified 2026-11-01)
- Cyber Security News: zero-click Android vulnerability, October 29, 2026 (verified 2026-11-01)
- AOSP: fix commit 735d967 in platform/frameworks/opt/telephony (verified 2026-11-01)
- Android security bulletin, October 2026 (verified 2026-11-01)
Spotted an error in this article? Report it · Our corrections policy
