Zero-click 'SMS of Death' flaw lets one malformed text crash Android phone service
- Severity
- Medium
- Sources
- 2
What happened
The bug is in WapPushOverSms.decodeWapPdu(), which converts a header length read as a long to a signed int without range checking. The bytes 88 80 80 80 00 become -2147483648, causing an uncaught NegativeArraySizeException that kills com.android.phone and ends calls with cause CSDEATH. Testing reportedly covered a Pixel 9 on April 2026 firmware and several Samsung Galaxy and A-series devices; about 20 messages caused prolonged disruption and about 30 corrupted the SMS SQLite store, causing a boot-time crash loop. No CVE ID or patch is mentioned, Google has marked it 'Won't Fix', and Android 17's 2G downgrade and SMS blaster protections do not appear to cover it. Recovery involved moving the physical SIM to a non-Android phone so the carrier's retries are acknowledged, then clearing the corrupt records over ADB; eSIM devices would be harder to recover.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist
General advice for this kind of story
Full story timeline · 2 updates
Who reported · 2 outlets
Who and what is in it
Companies