Independent researcher Mark Blaszczyk has documented a vulnerability dubbed SMS of Death that lets a remote attacker crash Android's telephony service with a single specially crafted WAP Push message, delivered as a binary SMS on port 2948.

Unlike normal texts, these messages are processed automatically and never appear in the inbox, making the attack fully zero-click.

The flaw sits in the WapPushOverSms component in Android's frameworks/opt/telephony path, which Security Affairs reports mishandles a uintvar-encoded header length: the value is read as a 64-bit number, then cast to a 32-bit integer without range checking, turning 0x80000000 into -2147483648 and triggering an uncaught NegativeArraySizeException.

That kills com.android.phone, the process responsible for calls.

The attack requires no user interaction, no link tap and no attachment, and the sender's number is not normally visible in any conversation.

Security Affairs reports each message processing causes roughly one to two seconds of lost telephony service while the component reboots, but the payload can linger in the SMS queue and be reprocessed during delivery attempts.

The researcher says he observed intermittent crashes for up to a week after a single message, that around twenty crafted messages can render a device unusable for an extended period, and that severe cases can enter a boot-loop-like state requiring ADB recovery — details that appear only in that outlet's account.

Cybersecurity Insiders adds the attack can leave users unable to receive calls or use messaging apps.

Testing attributed to the researcher shows the vulnerable code across Android versions 12 through 17, reproducible on the Google Pixel 9 and Samsung Galaxy and Galaxy A families.

Google has issued fixes for Android 14, 15, 16 and 17 — per Security Affairs, via the October 2026 security update, and GrapheneOS notes the flaw is assigned CVE-2026-58882 with Critical severity in the November 2026 Android Security Bulletin.

The gap is older devices: Android 12 and 13 may remain exposed where manufacturers no longer ship patches. Both outlets stress that protection comes down to checking your Android security patch level and updating promptly.

The most alarming consequence is that the crash interrupts active voice calls, including calls to emergency services, turning a simple malformed message into a denial of service against communications availability.

As Security Affairs observes, the attack involves no information theft, code execution or device control — yet it can still sever a victim's ability to reach help.

The episode underscores that background protocol machinery like WAP Push, originally designed for operator provisioning and configuration, remains an attack surface requiring rigorous validation and secure parsing.