Android SMS Flaw Allows Remote Phone Crashes

A zero-click denial-of-service vulnerability allows attackers to remotely crash unpatched Android phones by sending a specially crafted text message. The flaw interrupts ongoing calls without requiring user interaction. Android processes the malicious message before it reaches the SMS inbox, leaving victims with no visible indication of the crash. The vulnerability is caused by improper validation of a header-length value in the decodeWapPdu function. An attacker exploits this by sending a malformed eight-byte WAP Push message. When the exploit value is translated into a signed 32-bit integer without a bounds check, it becomes -2147483648. Android attempting to allocate memory using this negative value triggers a NegativeArraySizeException that crashes the com.android.phone process. This crash disrupts mobile connectivity and disconnects ongoing phone calls, including emergency services.

The attack can cause repeated crashes when carriers attempt to redeliver malicious messages or Android tries to process stored messages. Sending 20 malicious messages caused phones to get stuck in reboot loops during testing. On one Android 12 device, the phone rebooted into recovery mode approximately every 90 seconds. Users required a factory reset to recover from these reboot loops on affected devices. A GitHub contributor named Sakis discovered a way to remove malicious messages using Android Debug Bridge. The researcher has published a proof-of-concept exploit that can send the malicious messages from another Android device.

Google reportedly patched the vulnerability in its October 2026 Android security updates for Android versions 14 through 17. The flaw is not listed in Google's October security bulletin. Older Android 12 and 13 devices remain vulnerable because they did not receive the fix. Google's fix titled 'Fix remote DoS in decodeWapPdu' prevents crashes by catching exceptions triggered when processing malformed text messages.