The 'SMS of Death': Why Android's Refusal to Patch a Zero-Click DoS is a Wake-Up Call

Q: What exactly is the "SMS of Death" vulnerability?

A: As first reported by smsofdeath.com, it is a zero-click remote Denial of Service (DoS) vulnerability affecting Android telephony. An attacker can send a single malformed WAP Push SMS that crashes the `com.android.phone` process. Because the attack is zero-click, the victim does not need to tap a link or open a notification; the message is delivered as a data SMS and never appears in the user's inbox, meaning the sender's number remains hidden.

Q: How does the technical failure occur?

As detailed by smsofdeath.com, the issue lies in the `WapPushOverSms.decodeWapPdu()` function. The system reads the WSP header length as a `uintvar` (long), which is then cast to an `int` without a range check. A specific 5-byte header (88 80 80 80 00) decodes to 0x80000000, which, when cast to a signed 32-bit integer, becomes -2147483648. Attempting to allocate a byte array of this negative size triggers an uncaught `NegativeArraySizeException`, killing the telephony main thread.

Q: What is the real-world impact on the device?

Initially, the crash causes active voice calls—including emergency calls—to drop. While the process restarts, there is a brief telephony blackout. However, smsofdeath.com reports that the impact can escalate. Because carriers re-send unacknowledged messages, a single payload can cause intermittent outages for up to a week. Furthermore, sending approximately 30 messages in rapid succession can trigger a race condition that corrupts the SQLite database used for SMS storage. Once corrupted, the phone crashes on every boot, rendering it persistently unusable.

Q: How difficult is it to recover a "bricked" device?

Recovery is complex. Smsofdeath.com notes that a factory reset only provides temporary relief because the carrier will simply re-send the payload, triggering the crash again. Full recovery requires removing the physical SIM and placing it in a non-Android device (such as an iPhone) to acknowledge the messages, followed by clearing the corrupt database via ADB. For users with eSIMs, this process is significantly harder, as the SIM cannot be physically moved.

Q: What is the status of the fix from Google?

Independent researcher Mark Blaszczyk reported the vulnerability to the Android & Devices VRP on May 5, 2026. It was disclosed on October 29, 2026, after a 90-day timeline. Despite the risk, smsofdeath.com reports that the vendor status is "Won't Fix," and the issue has been classified as "Non-Security," resulting in no CVE being issued.

Q: Beyond the device crashing, are there regulatory implications?

Yes, specifically in Australia. Smsofdeath.com notes that under the ACMA-administered Telecommunications (Emergency Call Service) Determination, carriers are obligated to identify any mobile phones unable to reach "Triple Zero" (000) emergency services. Telstra has stated it is required to block devices that cannot make these calls if the issue isn't resolved within 28 days. Consequently, an attacker could remotely induce a condition that leads to a victim's device being barred from carrier service entirely.

*Opinion: This is a textbook example of the gap between corporate "security" narratives and reality. When a zero-click, persistent DoS that can cut off emergency services is dismissed as "Non-Security," it proves that the only economy that actually matters is the zero-day market, where the vulnerability's value is far higher than the cost of a patch to the vendor.*