TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report published Oct. 29 describes a malformed WAP Push SMS that can crash Android’s telephony process without the recipient interacting with the message. The researcher reports call drops and, after repeated delivery on tested devices, possible persistent failures; Android’s vendor response is listed as “Won’t Fix,” with the issue classified as non-security and no CVE issued.
An independent researcher has disclosed an Android telephony denial-of-service flaw that, according to the report, can be triggered by a malformed WAP Push SMS without the recipient opening or seeing a message. The report says the crash can drop active calls, including emergency calls; it also describes a more severe persistent failure after repeated delivery. The vendor status is listed as “Won’t Fix” and “Non-Security,” and no CVE has been issued.
The report, published by SMS of Death on Oct. 29, 2026, says the issue affects Android’s WapPushOverSms handling in the telephony framework. It attributes the crash to a WAP header length being read as a long, converted to a signed integer without a range check, then used as an array size. For the supplied five-byte value, that conversion produces a negative size and an uncaught NegativeArraySizeException on the telephony process’s main thread.
According to the researcher, the payload is delivered as a data SMS and does not appear in the recipient’s inbox. The report says the phone process restarts after a crash, causing a short loss of telephony service and termination of active calls. It further claims that carrier redelivery of an unacknowledged message can trigger repeat crashes. These effects are described by the researcher; the supplied material does not include independent confirmation from a device maker or carrier.
The report says rapid repeated delivery—about 30 messages in its testing—can coincide with writes to the SMS database and corrupt it, leaving telephony crashing on subsequent boots. The researcher reports reproducing the issue on a Pixel 9 running April 2026 firmware and on several Samsung Galaxy and A-series devices, with a 100% reproduction rate in those tests. That figure applies to the reported test set, not to all Android phones.
Call Access and Recovery Risks
The central concern is loss of reliable access to mobile calling, not simply an invisible message or a brief app crash. If the reported behavior occurs during an emergency, a dropped call or persistent telephony failure could prevent a person from reaching emergency services from that handset. The report specifically cites Australia’s Triple Zero system, but the broader practical risk depends on the device, carrier, location and local emergency-call arrangements.
The alleged persistent failure also changes the recovery picture. The researcher says a factory reset may not solve the problem if the carrier keeps redelivering the unacknowledged message, and describes clearing the SMS database as part of recovery. The report says this can be particularly difficult for people using eSIMs or without technical support. These are reported testing outcomes, not independently verified recovery instructions or a confirmed impact across Android devices.
For readers, the status matters: the report lists the issue as non-security and “Won’t Fix”, with no CVE. That means the published material does not identify a patch or a formal vulnerability identifier for users to track. It also does not establish that the issue is being exploited in the wild.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
How the WAP Push Crash Works
WAP Push is a messaging mechanism that can deliver data to a handset through SMS infrastructure. The report says the affected Android code decodes a WAP Push protocol header before dispatching the message. Its technical explanation identifies a missing bounds check: a header length read as an unsigned variable-length value is cast to a signed 32-bit integer, then used to allocate an array.
The researcher says the triggering value, 88 80 80 80 00, becomes 0x80000000 and then -2147483648 when represented as a signed integer. Attempting to allocate an array of that size raises the exception that terminates the telephony process. This explanation and the proof-of-concept are supplied by the report; the source warns that testing should be authorized and does not provide independent validation in the material provided here.
The report says it was submitted to Android and Devices through a vulnerability reporting program on May 5, 2026, and disclosed after a 90-day timeline. It lists no CVE and characterizes the vendor’s response as a non-security classification and “Won’t Fix.” The source also connects the issue to Australian rules on emergency-call access, but the exact application of carrier obligations to an individual case would depend on the regulator and carrier.
““Zero-Click · Remote DoS””
— SMS of Death report
Scope and Vendor Response
The report is the available source for the technical findings and affected-device tests. The supplied material does not include a response from Google, Samsung, mobile carriers or an independent security researcher. It is not clear which Android versions beyond the named test devices are affected, whether other manufacturers’ devices are vulnerable, or whether particular carrier configurations prevent delivery or redelivery.
There is also no evidence in the source material that attackers have used the issue outside testing. The claimed database corruption, extended outage and recovery difficulties are based on the researcher’s account; their frequency and reproducibility across a wider range of devices remain unknown. No patch, mitigation from a vendor, CVE or public exploitation assessment is included.
Watch for Vendor Guidance
Users and organizations should look for further guidance from Android, device makers and carriers, especially on whether software updates or network-side controls are available. The report provides no announced fix or release schedule. Until a vendor or carrier publishes technical advice, readers should treat the described effects as claims in an independent disclosure rather than a confirmed issue affecting every Android handset.
The next useful developments would be a vendor explanation of the “Non-Security” classification, confirmation of affected versions and models, and independently reproducible testing of the reported call and database effects. Any new advisory should also clarify what users can do if messages are repeatedly redelivered, particularly where a physical SIM cannot be moved to another device.
Key Questions
What is the reported Android issue?
The report says a specially malformed WAP Push SMS can trigger an unchecked array-size error in Android’s telephony code, crashing the phone process without the recipient opening a message.
Does the report say users have to tap or open anything?
No. The researcher describes the issue as zero-click: the message is said to be processed without user interaction and not shown in the inbox.
Can it affect emergency calls?
The report says a crash can terminate active calls, including emergency calls. That impact is a claim from the researcher and has not been independently confirmed in the supplied material.
Which phones are confirmed affected?
The researcher reports successful tests on a Pixel 9 with April 2026 firmware and several Samsung Galaxy and A-series devices. The report does not establish that every model or Android version is affected.
Is there a patch or CVE?
The report lists no CVE, a “Non-Security” classification and a “Won’t Fix” status. It does not identify a patch or published mitigation.
Source: hn
