TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published Oct. 29, 2026, describes a malformed WAP Push SMS that can crash Android’s telephony process without the recipient opening or seeing a message. The researcher reports dropped calls and, after rapid repeated deliveries, possible persistent telephony failure; Google classified the issue as “Won’t Fix” and “Non-Security,” according to the report. The claims have not been independently verified here, and the report says no CVE was issued.
An independent researcher has disclosed a reported zero-click Android denial-of-service flaw in which a malformed WAP Push SMS can crash the phone’s telephony process, potentially dropping active calls without the recipient seeing a message or taking action. The report, published Oct. 29, says Google classified the issue as “Won’t Fix” and “Non-Security”; no CVE has been issued, and the findings have not been independently verified for this article.
The report identifies the affected code as WapPushOverSms in Android’s telephony framework. It says the code reads a WAP Push header length, converts the value to a signed integer without checking its range, and uses that result as an array size. A crafted five-byte value can become a negative size, triggering an uncaught NegativeArraySizeException on the telephony process’s main thread.
According to the researcher, the message arrives as a data SMS and is not displayed in the inbox; the recipient gets no notification or visible sender number. A crash can interrupt service briefly and terminate active calls, including emergency calls. The report says carrier redelivery of an unacknowledged message may trigger repeat crashes, and that roughly 20 messages caused extended disruption in testing. Those impact details are the researcher’s claims, not findings confirmed by an independent test in the source material.
The report also describes a more severe scenario after approximately 30 rapid deliveries: crashes may coincide with writes to the SMS database and corrupt it, leaving the telephony process crashing on subsequent boots. The researcher says recovery can require stopping carrier redelivery and clearing damaged SMS records, and that a factory reset alone may not resolve the problem if messages are sent again. The source labels its proof of concept as working and restricts its use to authorised testing.
Call Access and Recovery Risks
The reported effect goes beyond an ordinary messaging-app crash because it targets telephony service. If the claim is accurate, a recipient may not know why calls are failing, and the interruption could matter most when the person needs to contact emergency services. The report specifically warns that emergency calls may be dropped or unavailable during the disruption; it does not establish that an emergency call was actually interrupted in a real-world incident.
The possibility of persistent failure also changes the practical stakes. A device that repeatedly loses telephony may be difficult for a nontechnical owner to recover, particularly if the carrier continues delivering the message. The researcher says recovery is harder on an eSIM-only device because the subscription cannot simply be moved to another handset. These consequences would depend on device, carrier behavior, and the reported database-corruption scenario.
The report points to Australia’s emergency-call rules as a further concern, stating that carriers have obligations when a handset cannot reach Triple Zero. That regulatory discussion is the researcher’s framing; the material provided does not establish how a carrier or regulator would respond to a device affected by this specific flaw.
Products Worth Considering
EcoFlow Smart Home Panel 2 Whole-Home Backup System Hub
DJI Osmo Pocket 3 Creator Combo Vlogging Camera with Mic 2, 1 CMOS, 4K/120fps, 3-Axis Stabilization, 128GB Card
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
As an affiliate, we earn on qualifying purchases.
Disclosure and Android Code Path
The researcher, Mark Blaszczynski, says the issue was reported to Android & Devices’ Vulnerability Reward Program on May 5, 2026, and disclosed on Oct. 29 after a 90-day timeline. The report lists the vendor status as “Won’t Fix” and the classification as “Non-Security,” and says no CVE was assigned. The source does not provide the vendor’s reasoning for that decision.
The reported failure involves an inbound WAP Push message, a form of SMS-based data delivery. The technical description traces the crash to a length value being cast from a long to an integer and then passed to an array allocation without a bounds check. The researcher says testing reproduced the issue on a Pixel 9 running April 2026 firmware and on various Samsung Galaxy and A-series phones, reporting a 100% reproduction rate across those tests. That is a reported test result, not confirmation that all Android devices or software versions are affected.
The report calls the vulnerability remote and silent because it says delivery requires no interaction and leaves no visible message. It also says the sender needs the target’s phone number. No public CVE is listed, and the source supplies no independent assessment of the number of devices exposed or evidence of exploitation outside testing.
““Non-Security””
— The SMS of Death report
Scope and Vendor Reasoning
The source is an independent researcher’s report and provides no public vendor response explaining why the issue was marked “Non-Security” or “Won’t Fix.” The affected Android versions, models, carriers, and conditions for successful delivery are not fully established in the supplied material. It also does not document real-world attacks or independently confirm the claimed emergency-call impact and persistent database corruption.
The report says the flaw has no CVE, and it does not identify a patch, mitigation, or device-by-device status. Its reproduction claims cover a limited set of named and described devices; they should not be read as proof that every Android phone is vulnerable. It is also unclear whether carriers can filter or otherwise prevent the specific WAP Push payload from being delivered.
Vendor Response and User Guidance
The next key development would be clarification from Google or affected device makers on the reported triage decision, affected software versions, and whether any remediation or carrier-side mitigation is available. The source material gives no announced patch date and no official instructions for people who suspect their device has been affected.
Until more information is available, readers should treat the proof of concept as restricted to authorised testing and should not attempt to send the described message. Anyone experiencing unexplained loss of telephony should use another working phone to contact their carrier or emergency services if needed. The report’s recovery suggestions are not presented here as vendor-approved guidance, and the source does not establish a general recovery procedure for affected devices.
Key Questions
What does the reported Android flaw do?
The report says a malformed WAP Push SMS can crash Android’s telephony process without the recipient opening a message. It claims this can interrupt service and drop active calls.
Does the recipient see the message?
According to the researcher, the data SMS is not shown in the inbox and does not produce a visible sender number or notification. That description has not been independently verified here.
Can the reported problem persist after a restart?
The report claims that rapid repeated deliveries can corrupt the SMS database and cause telephony crashes on later boots. It describes this as a possible outcome in testing, not a confirmed effect on all affected phones.
Has Google released a fix?
The supplied report lists the status as “Won’t Fix” and “Non-Security,” and gives no patch or mitigation. It does not include Google’s reasoning or a statement about future updates.
Is there a CVE for the issue?
No. The report says no CVE was issued as of its Oct. 29, 2026, disclosure.
Source: smsofdeath.com
