SMS of Death: zero-click Android telephony DoS
A zero-click denial-of-service vulnerability in Android telephony allows a single malformed WAP Push message to crash the telephony process and block emergency calls without user interaction. The flaw involves an unvalidated WSP header length cast to a signed integer, triggering a NegativeArraySizeException and a persistent device reboot loop. Google patched the issue in the October 2026 Android security update by widening exception handling and deleting the triggering message. Open article →
Notable comments
Reactions focused on whether Google’s “not a security issue” classification was warranted, with security/triage-process critiques and questions about real-world exploitability and carrier gating of telephony messages.
HN · mrb An ex-Google ISE says they would have flagged the report as “severe” in tiering because a “severe DoS” is still severe, and speculates tier-one triage may have dismissed it incorrectly.
HN · Wonderfall Provides concrete patch timing and attribution: a fix committed June 15 with CVE-2026-58882, GrapheneOS shipped via security preview by July, and otherwise lands in the November bulletin.
HN · jeroenhd Challenges practical risk by noting Google’s repeated “not a security issue” stance and questioning how an APK demo could send carrier-config WAP/call-drop messages when such messages normally come only from carriers and would require special confirmation.
- Android’s SMS of Death bug can knock out your phone, but a fix is coming soon
- A new vulnerability can brick your Android phone when receiving the SMS of Death
- ‼️ Google won't fix an Android bug that lets one invisible text crash a phone's calling service, ...
- 🚨 Zero-click “SMS of Death” flaw can crash Android phone services A researcher has disclosed an ...
- Zero click, silent, remote Android DoS
- A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls)