Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
An Android smartphone can be stripped of its mobile connection via a specially crafted SMS, without the user having to open the message, click a link, or even view the notification. The bug crashes the telephony system process, interrupts ongoing calls, including those to emergency services, and a series of messages can lock the device in a cycle of malfunctions and reboots.
An independent researcher disclosed the vulnerability on October 29, after several months of private discussion with Google. The attack was named SMS of Death and belongs to the Zero Click category, because it requires no interaction from the smartphone owner to trigger the error.
The issue lies in the WAP Push handler, an old mechanism for delivering service data over the mobile network. Carriers and applications have historically used WAP Push, for example, to work with MMS and mobile service settings. The malicious message is transmitted as a data SMS on a service port and does not appear in the normal conversation list, so the owner sees neither the text nor the sender’s number.
The error occurs inside the WapPushOverSms component while reading the WAP header length. Android initially receives a numeric value in 64‑bit format, then converts it to a signed 32‑bit integer without checking the valid range. A deliberately chosen value becomes negative after conversion, and the system attempts to create an array with a negative size. Java throws a NegativeArraySizeException, after which the com.android.phone process crashes.
Restarting the process takes only one to two seconds, but even such a brief interruption is enough to drop an ongoing voice call. Repeated sending turns the error into a remote service denial. In the researcher’s tests, a corrupted SMS in some cases caused periodic connection problems for a week, while about 20 messages rendered the smartphone practically unusable for an extended period.
Another issue is created by the same SMS delivery logic. In case of a process crash, the smartphone may fail to acknowledge receipt of the message, after which the mobile network will resend the corrupted packet. A copy also remains in Android’s internal queue and is processed again after reboot. Consequently, a single malicious message can trigger a new malfunction without any further sends from the attacker.
The researcher reproduced the error on a Pixel 9 with April 2026 firmware, as well as on various Samsung Galaxy and Galaxy A models. During testing, the malfunction occurred every time. The vulnerable code was reproduced from Android 12 up to Android 16, and the researcher attributes the affected range to Android 12‑17. The fix was released for Android 14‑17.
In the event of a prolonged malfunction cycle, Android may trigger the built‑in Rescue Party mechanism. The system attempts to automatically restore device operation, gradually applying more drastic measures. The final stage places the smartphone into recovery mode and offers a factory‑reset, which for an unprepared user could result in loss of local data.
A full reset is not always required. Corrupted entries can be removed from the internal SMS queue via Android Debug Bridge, but recovery will need a computer, ADB access, and a short window where Android can boot before the next malfunction. For the average smartphone user, this method is difficult to employ without technical preparation.
Google prepared a fix on June 15. Developers did not merely check the original numeric value. The patch catches RuntimeException during WAP Push processing and removes the corrupted message from the internal store, so Android does not attempt to parse the same packet after a new delivery or subsequent boot.
According to the researcher’s data, the fix was included in the October Android release for versions 14‑17. The October official bulletin does not describe SMS of Death separately, so smartphone owners should look at the latest firmware from the specific manufacturer, not just the Android version number. Devices with Android 12 and 13 may remain unpatched if the manufacturer does not release further patches or does not independently apply the protection.
The researcher also released a working demonstration of the attack. The program generates a corrupted WAP Push and sends the packet to the chosen phone number, so the technical details are already publicly available. There is no confirmed information on the use of SMS of Death in real‑world attacks, but publishing the working code simplifies verification of vulnerable devices and simultaneously lowers the barrier for potential malicious actors.
