TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published Oct. 29 says a malformed WAP Push SMS can crash Android’s telephony process without the recipient opening or seeing the message. The report says the issue was patched in Android’s October 2026 update; device coverage, carrier effects and the precise scope of the fix are not detailed in the supplied material.
A public report dated Oct. 29, 2026, describes an Android telephony flaw that can be triggered by a malformed WAP Push SMS, crashing the phone process without the recipient taking action. The report says the vulnerability was patched in Android’s October 2026 update; it warns that crashes can interrupt active calls, including emergency calls, and in some conditions leave a device repeatedly restarting.
The report, published by SMS of Death and credited to researcher Mark B, says the issue lies in Android’s WAP Push handling code, specifically WapPushOverSms.decodeWapPdu(). According to the technical account, the code reads a WSP header length as an unsigned variable-length value, converts it to a signed integer without checking its range, and uses the result to allocate an array. A crafted five-byte value can become a negative array size, triggering an uncaught exception on the telephony main thread.
The report says the process that fails is com.android.phone. Because the message is handled as a data SMS, the victim reportedly receives no visible message or notification and does not see the sender’s number. The report describes active calls being disconnected and a brief loss of service as the process restarts. It also says carriers may redeliver an unacknowledged message, causing repeated crashes; its testing reportedly found that a queued message could be retried after reboot and keep the device in a restart loop.
The researcher reports reproducing the crash on a Pixel 9 running April 2026 firmware and on multiple Samsung Galaxy and A-series devices. The supplied material does not identify every tested model or Android build. It says recovery from a persistent loop may require connecting the handset to a computer and using Android Debug Bridge (ADB) to remove the queued message. That method is attributed to contributor @sakisdog; the report says a factory reset may otherwise be the practical option for some users.
Emergency Calls and Device Recovery
The principal concern is that a telephony-process crash can affect a phone’s ability to place or maintain calls. The report says active calls, including emergency calls, can drop during the interruption. It does not establish that every device, carrier or emergency-call attempt would be affected in the same way, but the possibility raises the stakes beyond a routine app crash.
A repeated reboot loop could also leave someone without reliable access to calls, texts or other phone functions until they recover the device. The report says clearing the queued message through ADB can avoid erasing all device data, but that recovery requires a computer and technical steps. For people unable to use ADB, the difference between a brief outage and a prolonged loss of service may depend on access to support or a reset.
The report discusses Australia’s emergency-calling rules and says carriers may have obligations when a handset cannot reach Triple Zero. That regulatory discussion is relevant to the stated risk, but the supplied material does not establish that this vulnerability has caused a carrier to block any device or that a particular customer has lost service under those rules.
Products Worth Considering
Ring Alarm 5-Piece Wireless Security System
Ring Alarm 8-Piece Kit (2nd Gen) Home Security System
Ring Alarm 14-Piece Wireless Security System
As an affiliate, we earn on qualifying purchases.
How the WAP Push Crash Occurs
WAP Push is a messaging mechanism used to deliver content or service information to a handset. In the scenario described, the malformed message is sent remotely and processed by Android’s telephony software rather than displayed as an ordinary text in the inbox. The report characterizes the attack as zero-click and silent: it says the recipient need not open a message, follow a link or respond to a notification.
The technical account identifies an unchecked conversion of a header-length value as the cause of the crash. In the example provided, the five-byte value 88 80 80 80 00 decodes to a number that becomes -2,147,483,648 when cast to a signed 32-bit integer. Using that value as an array size raises a NegativeArraySizeException. The report says the exception is not caught before it terminates the telephony process.
The timeline in the supplied source lists the issue as reported on May 5, 2026, disclosed through an Android and Devices Vulnerability Rewards Program entry, and publicly written up on Oct. 29. It lists the status as patched in the October update. The report’s proof-of-concept is labeled for authorized testing; its existence does not establish that the issue has been used in real-world attacks.
““Zero-click, silent””
— SMS of Death report
Patch Coverage and Real-World Scope
The supplied material does not specify which Android versions and device builds are affected, whether the October update reaches all vulnerable devices, or how quickly handset makers and carriers will distribute it. Users should check their device’s security update status, but the source does not provide a patch identifier or a complete list of fixed builds.
The report describes testing across several devices and gives a claimed 100% reproduction rate in those tests. It does not provide the full test set or independent confirmation, so that figure should not be read as a guarantee that every Android phone is vulnerable. The material also does not document confirmed attacks against members of the public, cases of emergency calls being interrupted in real-world use, or carrier action under Australian rules.
The described severity depends on message handling and redelivery, and the report does not quantify how often carriers retry the message or how long service disruption would last across networks. It also does not state whether the ADB recovery method works on every affected Android version. Those details remain important for judging the practical risk and the options available to users.
Check for the October Security Fix
People using Android should check whether a security update is available for their handset and install the relevant update through the device’s normal system settings. Because the supplied report gives no complete list of affected models or build numbers, users who cannot confirm their patch status can seek guidance from their device maker or carrier. The report does not recommend downloading or testing the proof-of-concept on personal devices.
Further confirmation would come from a vendor advisory identifying affected versions and fixes, along with details from device makers about update availability. If a phone is stuck restarting, the report describes ADB-based deletion of the queued message as a recovery option, but it requires care; the source warns that clearing telephony-provider data can erase messages and settings. The scope of patch deployment, any verified real-world impact and whether carriers have issued specific customer guidance remain to be established.
Key Questions
What does the Android flaw reportedly do?
The report says a malformed WAP Push SMS can trigger an uncaught error in Android’s telephony process, causing it to crash. Repeated delivery or queued retries may lead to recurring outages or a restart loop, according to the report.
Does the recipient have to open the message?
No interaction is required in the scenario described by the report. It says the data message is processed without appearing in the inbox, so the recipient may not see the message or sender.
Has the issue been fixed?
The public report lists the vulnerability as patched in the Android October 2026 update. It does not provide a full affected-device list or patch identifiers, so users should check their handset’s update status and consult its maker for build-specific information.
Can a phone caught in a restart loop be recovered without a factory reset?
The report says a contributor documented an ADB method to remove the queued message, which may stop the loop without erasing all data. It requires a computer and technical steps, and the supplied material does not confirm that it works on every affected device.
Is there evidence that attackers are using this flaw?
The supplied material describes a working proof of concept and testing, but does not report confirmed attacks against the public. Real-world exploitation is not established by the information provided.
Source: smsofdeath.com
