TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A report published October 29, 2026, describes a malformed WAP Push SMS that can crash Android’s telephony process without the recipient opening or seeing a message. The report says the issue was patched in Android’s October 2026 update; the affected device range and carrier-level protections are not detailed in the supplied material.
A public report published October 29, 2026, describes an Android flaw in which a specially malformed WAP Push SMS can crash the phone’s telephony process without the recipient taking any action. The report says the crash can interrupt active calls, including emergency calls, and lists the issue as patched in Android’s October 2026 update.
The report attributes the failure to WapPushOverSms.decodeWapPdu(), part of Android’s telephony framework. It says the code reads a WAP header length, converts the value from a long integer to a signed integer without checking its range, and then uses the result as an array size. A five-byte value can become a negative number, causing an uncaught NegativeArraySizeException on the telephony process’s main thread.
According to the report, the message arrives as a data SMS and does not appear in the recipient’s inbox or show the sender’s number. The claimed result is a restart of com.android.phone, briefly interrupting network service and dropping active calls. The report says carriers may redeliver an unacknowledged message, potentially triggering repeated crashes; it also describes a persistent reboot loop when the queued message is retried after startup.
The author, identified as Mark B, says testing reproduced the issue on a Pixel 9 running April 2026 firmware and on various Samsung Galaxy and A-series devices. The report claims a 100% reproduction rate across those tests. That figure describes the author’s reported test set, not a measured rate across all Android phones. The report also credits a contributor with an ADB-based recovery approach, but says it requires a computer and technical steps.
Risks to Calls and Device Access
The reported failure matters because a phone’s telephony service handles both ordinary calls and access to emergency services. If the process repeatedly crashes or the device remains caught in a reboot loop, the owner may be unable to place calls reliably. The report specifically says active calls can drop, including emergency calls; it does not establish that every affected handset will lose emergency calling in every circumstance.
The issue also differs from a short-lived app crash in the report’s account: queued messages may be retried on startup, and restoring service may require intervention. The described ADB recovery is not a simple option for many users, while a factory reset can erase personal data. These possible outcomes make the reported flaw a device-availability concern, rather than a claim of data theft or remote access to the handset.
The report raises a further concern for Australian users because it connects loss of Triple Zero access with carrier obligations under emergency-call rules. It says carriers may need to identify and act on handsets unable to reach emergency services. The material does not establish how the vulnerability would interact with any carrier’s procedures in practice, so that consequence should be treated as a risk raised by the author, not a confirmed outcome of an attack.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
As an affiliate, we earn on qualifying purchases.
How the WAP Push Failure Works
WAP Push is a mobile messaging format processed by Android’s telephony components. The supplied report identifies the affected code as WapPushOverSms and says the message is sent remotely as a WAP Push using port 2948. Its central technical claim is that an unchecked conversion lets an attacker-controlled header length become a negative array size.
The report says the issue was reported May 5, 2026, and that Android and Devices VRP disclosed it on October 29, the date of the public write-up. It lists the October 2026 Android update as the patch. The supplied material does not include a Google advisory, a vulnerability identifier, or a version-by-version patch list, so those details cannot be independently established from this source alone.
The report describes repeated delivery as a factor that could extend disruption. It says a single message caused intermittent outages for up to a week in testing and that about 20 messages could make a device unusable for an extended period. Those are author-reported test outcomes; the material provides no independent validation or broader measurement.
“The message is delivered as a data SMS and is never shown to the user.”
— The SMS of Death report
Scope and Real-World Exposure
The supplied report does not give a complete list of affected Android versions, device models, carriers, or the exact security bulletin entry for the patch. It also does not provide independent confirmation of the reported reproduction rate, the duration of outages, or the circumstances in which carrier redelivery would repeat the crash. The number of devices affected, whether the issue was exploited outside testing, and whether any users experienced emergency-call disruption are not established in the material.
The report identifies a proof of concept and warns that it is for authorised testing only. This article does not reproduce its payload or operational instructions. The patch status is reported by the source, but readers should check their device’s update information to confirm whether the relevant update is installed.
Patch Status and User Guidance
The immediate next step is to verify whether the device has received the October 2026 Android update or a later security update that includes the fix. The report does not provide device-specific installation instructions or a complete list of supported updates, so users should consult their manufacturer or carrier’s official update information.
Further confirmation would clarify the affected build range, the precise patch identifiers, and whether carrier filtering or message-handling changes reduce exposure. If a device is already caught in a restart loop, the report says recovery may require ADB and cautions that its method is not accessible to every user. Users should seek help from the device manufacturer or a qualified support service rather than selecting a data-wipe option without understanding its consequences.
Key Questions
What is the reported Android vulnerability?
The report describes a malformed WAP Push SMS that can trigger a negative-array-size exception in Android’s telephony code and crash the phone process.
Does the recipient need to open or tap anything?
No interaction is required according to the report. It says the message is handled as a data SMS and does not appear in the inbox.
Can the flaw interrupt emergency calls?
The report says a crash can drop active calls, including emergency calls. It does not establish that emergency calling will fail on every affected device or in every situation.
Has the issue been patched?
The report lists the October 2026 Android update as the patch. It does not provide a complete device-by-device patch list, so users should check their manufacturer’s update information.
What if a phone is stuck restarting?
The report describes an ADB-based recovery that requires a computer and technical steps. It is not a straightforward option for all users; contacting the manufacturer or a qualified support service may be appropriate.
Source: smsofdeath.com
