TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published by SMS of Death describes a malformed WAP Push SMS that could crash Android’s phone process without user interaction, interrupting calls and, in testing, causing repeated crashes. The report says Google’s Android and Devices Vulnerability Reward Program disclosed the issue on Oct. 29, 2026, and that it was patched in the October 2026 update; affected-device scope and carrier-side protections are not detailed in the supplied material.
A public report describes an Android telephony vulnerability in which a specially malformed WAP Push SMS could crash the system phone process without the recipient tapping or opening anything. The report says the crash could drop active calls, including emergency calls, and that repeated delivery could leave some tested devices in a reboot loop; it lists the issue as patched in the October 2026 Android update.
The report, published by SMS of Death and attributed to researcher Mark B, identifies the affected code as Android’s WAP Push message handling in WapPushOverSms. It says the parser reads a WAP header length, converts the value to a signed integer without checking its range, and uses that integer as the size of a byte array. A particular five-byte value can become a negative array size, causing an uncaught exception on the telephony process’s main thread.
According to the report, the message is handled as a data SMS and is not displayed in the inbox; the recipient receives no visible prompt and the sender’s number is not shown. When the process fails, voice calls can disconnect, and the handset may briefly lose mobile service as the phone process restarts. The report says carriers may redeliver an unacknowledged message, causing further crashes. In the researcher’s testing, a queued message was retried after reboot, and repeated delivery could produce an extended denial of service.
The researcher says the issue reproduced on a Pixel 9 running April 2026 firmware and on various Samsung Galaxy and A-series models. The report gives a 100% reproduction rate across its tests, but does not provide the number of devices tested or a full list of software builds. It says the Android and Devices Vulnerability Reward Program disclosed the issue on Oct. 29, 2026, and identifies the October 2026 update as the patch. The supplied material does not include a Google statement or a vulnerability identifier.
Calls Can Fail During an Attack
The central risk is loss of reliable access to calling, not theft of messages or data. If the phone process is repeatedly crashing, a user may be unable to place or maintain a call at the moment they need one. The report specifically warns that this could affect calls to emergency services, although it does not document an incident in which an emergency call was actually blocked.
The report also describes a possible persistent device outage: a queued message could be processed again after reboot, leaving the phone repeatedly restarting until the message is removed or the software is updated. Its proposed recovery requires a computer and Android Debug Bridge, making it unsuitable for many people without technical help. The account says a factory reset may otherwise appear to be the available option to a user caught in a reboot loop.
For readers, the practical point is to install the relevant October 2026 security update if it is available for their device, and to seek support if a phone begins repeatedly restarting after receiving an unexplained message. The supplied report does not establish how widely the flaw was exploited, whether it was used outside testing, or which carriers and device configurations may have been exposed.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels
As an affiliate, we earn on qualifying purchases.
How the WAP Push Parser Failed
WAP Push is a mobile messaging mechanism that can carry service-related content through a data SMS. The report says the vulnerable Android code decoded a length field from the message and used it to allocate memory. Because the value was cast from a larger integer type to a signed 32-bit integer without a bounds check, an out-of-range value could become negative rather than being rejected as invalid.
The resulting failure is described as a NegativeArraySizeException that was not caught in the telephony process. That process handles core phone functions, so its failure can interrupt calls and mobile service while Android restarts it. This is a denial-of-service issue: the supplied report describes disruption, not code execution, data theft, or access to the victim’s contents.
The researcher says the issue was reported on May 5, 2026, and later disclosed through the Android and Devices Vulnerability Reward Program on Oct. 29. The write-up also credits contributor @sakisdog with documenting a recovery approach that removes the queued messages through ADB. That procedure requires technical steps and is not equivalent to a fix; the report presents installing the patch as the software remediation.
“Zero-click, silent, remote DoS.”
— SMS of Death report
Exposure and Real-World Impact
The supplied material does not say how many Android devices were affected, which versions beyond the tested examples were vulnerable, or whether all manufacturers delivered the stated October patch on the same schedule. It also does not identify any confirmed attacks against members of the public. The reproduction claim is the researcher’s account; the number and configuration of test devices are not specified.
It is also unclear whether carrier systems or device settings could prevent delivery or repeated redelivery in some cases. The report describes emergency-call disruption as a possible consequence of telephony crashes, but provides no documented emergency-call test results or affected-user cases. Google’s technical explanation, an official vulnerability identifier, and a detailed patch description are not included in the supplied source.
Patch Availability and User Guidance
The immediate next step is for Android users to check their device’s security update status and install the October 2026 update if it is offered for their model. Availability can depend on the manufacturer, device, and carrier. Users whose phones are stuck restarting should contact the manufacturer or carrier for assistance; the report’s ADB recovery instructions involve modifying message storage and are intended for technically capable users, not as a general consumer procedure.
Further confirmation would help establish the affected software range, the patch’s technical scope, and whether the issue was observed beyond controlled testing. Until those details are available, the public report supports a specific conclusion: a malformed WAP Push message could crash Android’s telephony process on tested devices, and the report says a patch was included in the October 2026 update.
Key Questions
What does the reported Android flaw do?
According to SMS of Death, a malformed WAP Push SMS can trigger an uncaught error in Android’s telephony process, interrupting calls and mobile service. The report describes denial of service, not data theft or remote control.
Does the recipient have to open the message?
No interaction is required in the report’s account. It says the message is processed silently as a data SMS and does not appear in the recipient’s inbox.
Could emergency calls be affected?
The report says active calls, including emergency calls, could be dropped when the phone process crashes. It does not provide evidence of a real-world emergency call being blocked, so that impact is a reported risk rather than a documented incident.
Has the issue been patched?
The report lists the vulnerability as patched in the October 2026 Android update. It does not specify when that update became available for each manufacturer or handset, so users should check their device’s update settings.
What if a phone keeps rebooting?
The report says queued messages may be retried after reboot and credits @sakisdog with an ADB-based recovery approach. That method requires a computer and technical steps; people affected should contact their device maker or carrier for help, and the supplied report does not offer a simple on-device recovery option.
Source: smsofdeath.com
