SMS of Death: Zero-Click Vulnerability in Android Telephony Drops Calls and Causes Boot Loops

The Three-Question Framework

What Happened?

On October 29, 2026, security researcher Mark B publicly disclosed 'SMS of Death', a zero-click remote Denial-of-Service vulnerability residing within Android's telephony subsystem (frameworks/opt/telephony). By transmitting a malformed WAP Push message containing a crafted 5-byte header to port 2948, an attacker triggers an unhandled NegativeArraySizeException inside com.android.phone. The flaw requires zero user interaction, displays no visible notification, drops all active voice calls with DisconnectCause CS_DEATH, and severs connections to emergency numbers such as Triple Zero (000).

Why It Matters

Because carrier networks automatically retry unacknowledged data SMS transmissions, a single attack payload repeatedly crashes the target device for days. Poison payloads persist within the inbound database (content://sms/raw), causing Android to crash upon every startup until RescueParty forces a reboot into recovery mode every 90 seconds, often compelling victims into a destructive factory reset. Under Australian telecommunications regulations, carriers are mandated to disconnect handsets unable to access emergency services, turning this bug into an automated network-level device barring weapon.

What Could Happen Next

Google remediated the vulnerability in the October 2026 Android Security Update (commit 735d967, 'Fix remote DoS in decodeWapPdu') across Android versions 14 through 17. The vendor fix widens exception handling from ArrayIndexOutOfBoundsException to general RuntimeException and automatically drops corrupted message parts from the raw storage database. Unpatched devices remain vulnerable, though technical users can mitigate active reboot loops without factory resetting by querying and purging poison rows over ADB.

Executive Key Takeaways

Zero-click remote flaw in Android WapPushOverSms crashes com.android.phone via integer truncation in 5-byte header.

Terminates active cellular calls with DisconnectCause CS_DEATH and blocks outgoing emergency service calls.

Poison SMS persists in telephony SQLite table, triggering 90-second RescueParty reboot loops until cleared via ADB or factory reset.

Source: Security research advisory published October 29, 2026, by Mark B, titled 'SMS of Death: zero-click Android telephony DoS'.

The vulnerability originates in WapPushOverSms.decodeWapPdu(), where the parser reads a WSP header length as a variable-length unsigned integer (uintvar) returning a 64-bit long. The code casts this value to a signed 32-bit integer without bounds checking before allocating memory. When supplied with a crafted 5-byte sequence of 0x88 0x80 0x80 0x80 0x00, the parser decodes 0x80000000, which evaluates to -2,147,483,648 upon casting. Attempting to allocate an array of negative length immediately throws a fatal NegativeArraySizeException on the telephony main thread.

Because com.android.phone manages all cellular modem state, its immediate death tears down ongoing calls with DisconnectCause CS_DEATH and induces 1 to 2 seconds of total cellular blackout while the process restarts. Crucially, the inbound packet is handled entirely within background telephony services without generating notifications or logging records in user-visible messaging applications, leaving victims unaware of the attack source.

Persistent denial of service emerges from carrier delivery protocols. When the telephony stack crashes mid-parse, the carrier never receives an SMS delivery acknowledgement and re-transmits the payload repeatedly. Concurrently, Android stores the unfinished message part in content://sms/raw. On subsequent system boots, the subsystem attempts to parse the stored entry, crashing com.android.phone in a cycle that prompts RescueParty to trigger recovery mode within 90 seconds.

The Three-Question Framework

What Happened?

Why It Matters

What Could Happen Next

Executive Key Takeaways

Primary Sources & Citations