A freshly disclosed vulnerability in Android can render a phone’s telephony service unusable — all from a single malformed text message. Dubbed the “SMS of Death,” this zero-click flaw targets the WAP Push feature, allowing an attacker to sever calls, disrupt service, and in some cases leave devices completely offline even after reboot. Google has classified the bug as “Won’t Fix.”
What happens under the hood
The flaw lies in the “WapPushOverSms.decodeWapPdu()” function, which handles WAP Push messages — special data-texts that bypass the user’s normal inbox. The vulnerable code reads a header length as a large number, then converts it to a signed integer without validating its magnitude. With crafted input (five bytes “88 80 80 80 00”), the conversion yields a deeply negative value (–2,147,483,648). Android then tries to allocate an array of that size, triggering a “NegativeArraySizeException.” This crashes the core phone process, but the victim won’t receive any alert — no inbox item, no notification, no trace of the sender visible.
Impact: from dropped calls to broken phones
Users on active calls see them abruptly terminate under the status “CS_DEATH” when the phone service crashes and restarts. Even a single message can knock service down for one or two seconds. In longer tests, repeated incoming messages led to ongoing outages, some lasting a week, because the carrier kept resending messages the device never acknowledged. Worse still, about 20 of these malicious messages left phones unable to recover without external intervention.
Testing confirmed the flaw works consistently across devices: a Pixel 9 running firmware from April 2026, various recent Samsung Galaxy models, and Samsung A-series phones all crashed under repeated testing. The issue can escalate when dozens of malformed messages arrive in rapid succession: the phone’s SMS database (managed via SQLite) may become corrupted, causing the phone app to fail at every boot. A factory reset sometimes helps — but only until the carrier begins resending the offending payload.
Why recovery is hard
Fixing the situation often demands creative workarounds. One tested method involved moving the physical SIM into a non-Android handset, which could acknowledge the repeated messages, halting repeated resend attempts from the carrier. Afterwards, access via Android Debug Bridge (ADB) was needed to remove corrupted records. Devices using eSIMs face steeper challenges, as there’s no physical SIM for this workaround. For many users, those processes are impractical.
Android already faced other zero-click threats — past exploits involving fake cell towers or SMS blasters, for example. Android 17 includes protections against 2G downgrades and some SMS-based abuse, but this decoding bug appears outside those safeguards, and isn’t addressed by standard patches.
Despite the severity, Google has tagged the issue as a non-security problem and declined to issue a fix for it — a stance likely to draw criticism given how dire the consequences are in practice.
Why this matters: This vulnerability highlights how deep technical oversights in less visible components — like protocol parsers and message-handlers — can lead to serious, persistent disruption. Users and organizations should monitor both firmware updates and carrier behavior. In the meantime, vendors must reassess how internal message validation is prioritized. What’s to watch: will Google reverse its decision, and will OEMs push out user-facing mitigation? This could become a turning-point case in how Android handles zero-click flaws going forward.
