Zero-Click 'SMS of Death' Flaw Can Render Android Phones Unusable
A critical zero-click vulnerability in Android's WAP Push message handling can crash phone services and permanently disable telephony with repeated exploitation.
A security researcher has disclosed details of a severe zero-click vulnerability affecting Android devices, dubbed 'SMS of Death.' This flaw allows attackers to crash a phone's telephony service, drop active calls, and, in the most severe cases, render the device unusable for calls and texts without significant manual intervention.
The vulnerability resides within the WapPushOverSms.decodeWapPdu() function, which processes WAP Push messages. These are special data-only text messages that do not appear in the user's inbox. The exploit involves sending a malformed WAP Push message containing specific byte sequences that, when processed by the vulnerable function, lead to an integer overflow. The function attempts to convert a header length from a five-byte value into a smaller signed integer, mishandling the range and resulting in a value of -2147483648.
This negative value causes Android to attempt creating a byte array of an impossible size, triggering an uncaught NegativeArraySizeException. This exception terminates the com.android.phone process, causing immediate service disruption. Users experience a brief loss of service, typically one to two seconds per message, with active calls being dropped. Crucially, the attack is zero-click, meaning the victim receives no notification, and the sender's identity remains hidden.
While a single message causes temporary outages, repeated messages can lead to more persistent issues. The Android system, unable to acknowledge the messages, will repeatedly attempt to resend them. In testing, approximately 20 such messages corrupted the device's SMS database, which stores all messages. This corruption causes the phone app to crash every time the device boots, making the phone effectively unusable for communication.
The researcher confirmed the vulnerability's impact on various devices, including Google Pixel 9 running April 2026 firmware, and several Samsung Galaxy and A-series models. While Google has reportedly marked the issue as 'Won't Fix,' classifying it as a non-security concern, the practical implications for users are severe. Existing Android protections against other zero-click threats, such as those targeting 2G downgrade attacks, do not address this specific parsing bug.
Recovering a device affected by the 'SMS of Death' is challenging. A factory reset offers only a temporary reprieve, as the carrier will retransmit the malicious payload, re-corrupting the database. The researcher's workaround involved transferring the physical SIM card to a non-Android device (like an iPhone) to acknowledge the queued messages, followed by clearing the corrupt records via ADB. For users relying solely on eSIMs or lacking technical expertise, recovery could be significantly more difficult, potentially requiring a SIM swap or professional assistance.
This vulnerability highlights the ongoing risks associated with message parsing and zero-click exploits on mobile platforms. While distinct from the BLASTPASS vulnerability affecting iPhones in 2023, 'SMS of Death' underscores the persistent threat of sophisticated attacks that can disrupt core device functionality without any user interaction, demanding continued vigilance and robust security patching from manufacturers.