By 
The recent discovery of a vulnerability in Android devices, known as the SMS of Death, has raised serious concerns about the security of mobile communication. This flaw enables malicious actors to disrupt phone services by sending a concealed message that can affect call functionality, including emergency calls. Surprisingly, this attack does not require any interaction from the victim, making it particularly alarming.
Researchers have revealed that an intricately crafted WAP Push message can crash the telephony services on Android smartphones. When a device receives this specially formatted message, the effects can be devastating: ongoing calls can be interrupted, and the phone may become temporarily unusable. The ability to block emergency services is especially troubling, as it could mean the difference between life and death in critical situations.
The SMS of Death depends on a zero-click vulnerability, meaning it activates without requiring the recipient to open the message or click any links. This automated processing of data SMS transmitted over the wireless network makes it a significant security risk. The mechanism behind this attack is found in the Android framework component, WapPushOverSms, which interprets WAP Push messages, generally designed for delivering data and notifications.
In terms of technical specifics, the flaw stems from how the Android system handles message interpretation. The decodeWapPdu() function, responsible for determining the length of the message, processes certain numeric values without proper range checking. This oversight can transform what appears to be a normal size value into a negative number, leading to a crash in the telephony process. Essentially, when this occurs, Android tries to allocate an array of a negative size, which is impossible and results in a NegativeArraySizeException that crashes the system.
To illustrate just how minimal the trigger for this vulnerability can be, the researcher highlighted an example where a five-byte value can lead to an error sufficient to disrupt service. With only a select few bytes, a capable attacker can exploit this flaw. Furthermore, the nature of the message means that it will not appear in the recipient's inbox, nor will there be any notification, adding a layer of stealth to the attack.
When a vulnerable device processes a malicious WAP Push message, users may experience a disruption in phone service lasting from one to two seconds, as the system attempts to recover. However, the implications do not end there. With the flawed message lingering in the device's incoming queue, repeated processing attempts can exacerbate the situation, potentially yielding a Denial of Service condition that renders the phone unusable for extended periods. In some extreme cases, persistent crashes may lead to boot loops where the phone continuously fails to start up correctly.
The ramifications of such a vulnerability extend beyond just inconvenience. Disrupting communications availability can severely impact users, especially when they are attempting to reach emergency services. As many of us increasingly rely on our smartphones for all forms of communication, including urgent calls, the implications of this flaw remind us of the critical need for robust security measures.
Testing has demonstrated the reproduceability of this vulnerability across several devices, particularly within the Google Pixel series and Samsung Galaxy models, specifically those from the Galaxy and Galaxy A ranges. This vulnerability appears to affect Android versions from 12 to 17, but, notably, users of older operating systems may remain at risk as manufacturers phase out updates.
For users concerned about potential exposure, it is advisable to keep Android devices up to date with the latest security patches. Google has acknowledged the issue and has worked on a fix which was included in the October 2026 security updates for Android 14, 15, 16, and 17. However, if you are using an older Android version, it is crucial to stay vigilant as those devices may not receive necessary patches to remediate this vulnerability.
Source: securityaffairs.com
