Threat reportVulnerabilityTL-2026-4801
"SMS of Death" Zero-Click Android Denial-of-Service via WapPushOverSms.decodeWapPdu() (Android 14-17)
"SMS of Death" Zero-Click Android Denial-of-Service via (TL-2026-4801), also tracked as SMS of Death, is a medium-severity software vulnerability, first published 2026-10-30. It has no confirmed attribution, affects Google Android (telephony framework: WapPushOverSms, maps to 4 MITRE ATT&CK techniques (T1499.004, T1587.004, T1642), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4801
- Threat ID
- TL-2026-4801
- Also known as
- SMS of Death, WapPushOverSms decodeWapPdu NegativeArraySizeException DoS
- Severity
- MEDIUM
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecoms, government administration, finance, health, enterprise mobile fleets, emergency services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in "SMS of Death" Zero-Click Android Denial-of-Service via
Malware and tooling: SMS of Death PoC
How "SMS of Death" Zero-Click Android Denial-of-Service via works
A zero-click Android flaw lets a remote attacker crash the telephony process (com.android.phone) with a single malformed WAP Push SMS; around 20 messages left tested devices unusable for extended periods. Android 14 through 17 are affected; Google fixed it in the October 2026 Android security update. No CVE has been published.
"SMS of Death" is a remote, zero-click denial-of-service vulnerability in the Android telephony framework (frameworks/opt/telephony), in WapPushOverSms.decodeWapPdu(). The decoder reads the Wireless Session Protocol (WSP) header length as a variable-length unsigned integer (uintvar), then casts it to a signed 32-bit int without range validation. An oversized value becomes negative after the cast. According to the researcher's write-up, the 5-byte uintvar 88 80 80 80 00 decodes to 0x80000000, which becomes -2147483648 and is then used as an array allocation size.
The negative size raises a NegativeArraySizeException that nothing catches on the main telephony thread. The exception terminates the com.android.phone process. The trigger is a malformed WAP Push data SMS delivered to port 2948, so it needs no user interaction. The payload does not appear in the messaging inbox and exposes no sender information, so the victim gets no visible indication. Each crash costs roughly one to two seconds of telephony service, according to the GBHackers coverage.
The write-up reports that the message stays in the raw SMS queue and re-triggers the crash on reboot, producing a crash/boot loop. A single message caused intermittent outages lasting up to a week, and about 20 messages produced extended unusability. Voice calls and access to emergency services are affected. The researcher reports 100% reproduction on a Pixel 9 (April 2026 firmware) and on Samsung Galaxy and Galaxy A-series devices.
Google's fix (AOSP commit 735d9672603fa206c4b43cb668c1aa273db70b97, authored 2026-06-15 and committed 2026-08-05, bug b/517376969) does not add upstream bounds validation. It catches RuntimeException during WAP push PDU decoding and during SMS broadcast, logs a warning, and deletes the poison message from the raw SMS database so it cannot re-crash the device. It also adds a warning log for a null inbound SMS tracker. The changed files are InboundSmsHandler.java and WapPushOverSms.java, plus their unit tests. The issue was reported to Google's Android and Devices VRP on 2026-05-05 by researcher Mark B (@sourone). Technical disclosure and a PoC were published on 2026-10-29 at smsofdeath.com.
No in-the-wild exploitation, threat actor or network infrastructure has been reported. Severity MEDIUM is an analyst-assigned estimate, because the impact is availability only and no CVE or CVSS score exists. Defenders should deploy the October 2026 (or later) Android security patch level and monitor for repeated com.android.phone crashes and unexplained telephony outages.
MITRE ATT&CK techniques used in TL-2026-4801
Impact
T1499.004 Endpoint Denial of Service: Application or System Exploitation; T1642 Endpoint Denial of Service
Resource Development
T1587.004 Develop Capabilities: Exploits
Initial Access
Affected products and versions in "SMS of Death" Zero-Click Android Denial-of-Service via
- Google — Android (telephony framework: WapPushOverSms, InboundSmsHandler)
Vulnerable versions: Android 14; Android 15; Android 16; Android 17
Fixed in: Devices at the October 2026 Android security patch level or later - Google — Pixel 9 (tested on April 2026 firmware)
Vulnerable versions: April 2026 firmware
Fixed in: October 2026 security update - Samsung — Galaxy series and Galaxy A-series (tested)
Vulnerable versions: Android 14-17 builds without the October 2026 patch
Fixed in: Builds with the October 2026 Android security patch level
Remediation for "SMS of Death" Zero-Click Android Denial-of-Service via
Patches
- October 2026 Android security update (AOSP fix commit 735d9672603fa206c4b43cb668c1aa273db70b97)
- OEM (Samsung and others) security updates that incorporate the October 2026 Android patch level
Immediate actions
- Install the October 2026 Android security update (or later) on all Android 14-17 devices
- Prioritise Pixel and Samsung Galaxy fleets, which were the tested devices
- Alert helpdesk and MDM teams to repeated com.android.phone crashes and sudden loss of cellular service as indicators
Workarounds
- No user-side workaround is documented in the sources; the device cannot be protected without the patch
Longer-term hardening
- Use MDM to report and enforce a minimum Android security patch level
- Ask carriers whether they can filter WAP Push (port 2948) data SMS from untrusted sources
Weaknesses (CWE) in "SMS of Death" Zero-Click Android Denial-of-Service via
Timeline of "SMS of Death" Zero-Click Android Denial-of-Service via
- Mark B (@sourone) reported the issue to Google's Android and Devices Vulnerability Reward Program.
- Google authored the fix (AOSP commit 735d967, bug b/517376969): catch RuntimeException during WAP push PDU decoding and SMS broadcast, and delete poison messages from the raw SMS table.
- The fix commit was committed to AOSP frameworks/opt/telephony.
- Google's October 2026 Android security update shipped fixes for Android 14 through 17 (bulletin month per sources; exact day not stated, so the 1st is used).
- Technical write-up and PoC published at smsofdeath.com, describing the uintvar-to-signed-int cast flaw in WapPushOverSms.decodeWapPdu().
- GBHackers reported the vulnerability. No CVE, in-the-wild exploitation or threat actor was reported.
Sources cited for "SMS of Death" Zero-Click Android Denial-of-Service via
- New Zero-Click Android Vulnerability Lets Attackers Crash Phones With a Single SMS (GBHackers)
- SMS of Death: Technical Analysis (Mark B / @sourone)
- AOSP frameworks/opt/telephony commit 735d967: catch RuntimeException in WAP push PDU decoding
- AOSP frameworks/opt/telephony commit 567ea11 (earlier WAP push hardening)
- Researchers discover SMS-based vulnerabilities in Samsung Galaxy devices (prior WAP push DoS research)
- Original 'SMS of Death' (Mulliner and Golde, CCC) - NBC News
Detection coverage for TL-2026-4801
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4801 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.