# "SMS of Death" Zero-Click Android Denial-of-Service via WapPushOverSms.decodeWapPdu() (Android 14-17)

> A zero-click Android flaw lets a remote attacker crash the telephony process (com.android.phone) with a single malformed WAP Push SMS; around 20 messages left tested devices unusable for extended periods. Android 14 through 17 are affected; Google fixed it in the October 2026 Android security update. No CVE has been published.

- **Published:** 2026-10-30T05:39:24Z
- **Last reviewed:** 2026-10-30T05:39:24Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4801
- **ID:** TL-2026-4801
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

"SMS of Death" is a remote, zero-click denial-of-service vulnerability in the Android telephony framework (frameworks/opt/telephony), in WapPushOverSms.decodeWapPdu(). The decoder reads the Wireless Session Protocol (WSP) header length as a variable-length unsigned integer (uintvar), then casts it to a signed 32-bit int without range validation. An oversized value becomes negative after the cast. According to the researcher's write-up, the 5-byte uintvar 88 80 80 80 00 decodes to 0x80000000, which becomes -2147483648 and is then used as an array allocation size.

The negative size raises a NegativeArraySizeException that nothing catches on the main telephony thread. The exception terminates the com.android.phone process. The trigger is a malformed WAP Push data SMS delivered to port 2948, so it needs no user interaction. The payload does not appear in the messaging inbox and exposes no sender information, so the victim gets no visible indication. Each crash costs roughly one to two seconds of telephony service, according to the GBHackers coverage.

The write-up reports that the message stays in the raw SMS queue and re-triggers the crash on reboot, producing a crash/boot loop. A single message caused intermittent outages lasting up to a week, and about 20 messages produced extended unusability. Voice calls and access to emergency services are affected. The researcher reports 100% reproduction on a Pixel 9 (April 2026 firmware) and on Samsung Galaxy and Galaxy A-series devices.

Google's fix (AOSP commit 735d9672603fa206c4b43cb668c1aa273db70b97, authored 2026-06-15 and committed 2026-08-05, bug b/517376969) does not add upstream bounds validation. It catches RuntimeException during WAP push PDU decoding and during SMS broadcast, logs a warning, and deletes the poison message from the raw SMS database so it cannot re-crash the device. It also adds a warning log for a null inbound SMS tracker. The changed files are InboundSmsHandler.java and WapPushOverSms.java, plus their unit tests. The issue was reported to Google's Android and Devices VRP on 2026-05-05 by researcher Mark B (@sourone). Technical disclosure and a PoC were published on 2026-10-29 at smsofdeath.com.

No in-the-wild exploitation, threat actor or network infrastructure has been reported. Severity MEDIUM is an analyst-assigned estimate, because the impact is availability only and no CVE or CVSS score exists. Defenders should deploy the October 2026 (or later) Android security patch level and monitor for repeated com.android.phone crashes and unexplained telephony outages.

## MITRE ATT&CK

- T1587.004 Develop Capabilities: Exploits
- T1664 Exploitation for Initial Access
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1642 Endpoint Denial of Service

## Sources

- [New Zero-Click Android Vulnerability Lets Attackers Crash Phones With a Single SMS (GBHackers)](https://gbhackers.com/new-zero-click-android-vulnerability/)
- [SMS of Death: Technical Analysis (Mark B / @sourone)](https://smsofdeath.com/)
- [AOSP frameworks/opt/telephony commit 735d967: catch RuntimeException in WAP push PDU decoding](https://android.googlesource.com/platform/frameworks/opt/telephony/+/735d967)
- [AOSP frameworks/opt/telephony commit 567ea11 (earlier WAP push hardening)](https://android.googlesource.com/platform/frameworks/opt/telephony/+/567ea11%5E%21/)
- [Researchers discover SMS-based vulnerabilities in Samsung Galaxy devices (prior WAP push DoS research)](https://informationsecuritybuzz.com/?p=100455)
- [Original 'SMS of Death' (Mulliner and Golde, CCC) - NBC News](https://www.nbcnews.com/id/wbna40931909)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4801