‘SMS of Death’ flaw cuts off Android calls without user interaction

A malformed text message can silently crash Android’s telephony service and disconnect calls, including emergency calls.

Repeated delivery can leave affected phones unable to maintain cellular service even after restarting.

Independent researcher Mark Blaszczyk published the findings on October 29, nearly six months after reporting the issue to Google. His disclosure says Google ultimately classified it as a non-security issue and declined to fix it.

Blaszczyk reports successful reproduction on a Pixel 9 running April 2026 firmware and multiple Samsung Galaxy devices, including A-series models. The report does not establish a comprehensive list of affected Android versions, handsets, or carrier networks.

The issue lies in Android’s telephony framework, which processes incoming cellular messages separately from the messaging app users interact with. Its WapPushOverSms component handles WAP Push messages, a form of data SMS.

A silent telephony crash

The flaw occurs when WapPushOverSms.java reads a message’s declared header length and converts it from a long integer to a signed 32-bit integer without checking its range.

A specially crafted value becomes negative during that conversion. Android then attempts to allocate a byte array using the negative length, triggering a NegativeArraySizeException that, according to the report, terminates the com.android.phone process.

Because the payload arrives as a data SMS, Blaszczyk says it produces no inbox entry or notification and does not reveal the sender’s number to the recipient. No link opening, app installation, or other victim interaction is required.

In his testing, each crash interrupted telephony for one to two seconds while the process restarted, terminating active voice calls. He also reports that carrier retries of unacknowledged messages caused intermittent disruption for up to a week after a single malicious message.

Persistent disruption and disputed classification

Rapid delivery of roughly 20 to 30 messages reportedly caused more lasting failures. Blaszczyk attributes these to a race condition that corrupts the SQLite database used for SMS storage, causing the telephony process to crash again whenever the phone boots.

That explanation remains the researcher’s assessment. The report describes persistent telephony loss rather than demonstrating irreversible hardware damage.

Blaszczyk says a factory reset offered only temporary relief because queued messages were subsequently redelivered. His recovery procedure involved moving the physical SIM to a non-Android handset to acknowledge outstanding messages, then clearing affected SMS records through Android Debug Bridge. He warns that recovery could be more difficult for eSIM users.

The researcher first submitted the issue on May 5 and later appealed Google’s decision through additional tickets. His published timeline says Google reaffirmed its non-security classification on October 29.

Blaszczyk proposed validating the header length before converting it and has released a proof-of-concept application and source code on GitHub. As of today, there’s no CVE identifier for this flaw.