SMS of Death: one silent text can crash Android's phone service

A researcher known as Mark B has published a writeup called SMS of Death, describing a flaw in Android's telephony code where a single malformed WAP Push text message can crash the phone app, dropping active calls, including emergency calls, with no interaction from the victim. The message never shows up in the Messages app, so the victim sees nothing.

According to the writeup, a crafted 5-byte value in the message is misread as a negative array size, triggering an uncaught exception that kills Android's phone process. Because unacknowledged messages get resent by carriers and retried on every boot, the researcher says a single message caused intermittent outages for up to a week in testing, and around 20 messages can render a device unusable for an extended period. The flaw was reported to Google's Android and Devices VRP on May 5, 2026, and disclosed publicly on October 29, 2026.

Google fixed the issue in its October 2026 security update, covering Android 14 through 17, by widening the caught exception and deleting the offending message so it cannot re-crash the device. Android 12 and 13 do not receive the fix and remain affected, per the researcher.

Why it matters

It's a zero-click bug that can silently knock a phone off emergency calling, and older Android versions won't be patched.

Source: SMS of Death