Android’s “SMS of Death” can disrupt phone service without a tap
A researcher describes telephony crashes caused by an automatically processed message. AOSP contains a fix, but delivery to an individual handset still needs checking.
Going deeper
Generated image · SecuFocus
At a glance
Key points
Android can process a message before it reaches your inbox. On October 29, researcher Mark B published an analysis showing how a malformed SMS can crash the telephony process, drop calls and cause repeated restarts. Google’s code repository contains a fix. Whether your handset has received it is a separate question for the device maker’s update record.
The victim does not have to open a message
The “SMS of Death” analysis describes a WAP Push data message handled by the telephony framework. A decoding error can terminate com.android.phone. The researcher reports dropped calls, including emergency calls, with redelivery or queued messages extending the disruption.
The scenario requires neither a tap nor an app installed by the victim. It is a denial-of-service finding, not a demonstration of reading all messages or taking over a phone. SecuFocus has not run the proof of concept or reproduced the author’s claimed success rate.
An AOSP fix is not a handset deployment list
Google’s official repository contains a change titled “Fix remote DoS in decodeWapPdu”. It handles decoding exceptions and removes the triggering message to prevent recurring crashes. That establishes a code correction, not which devices have received it.
The researcher places delivery of the fix in October 2026 updates for Android 14 through 17 and reports exposure on older devices. Check the installed patch level and the manufacturer bulletin for the exact model. A month appearing in a general Android bulletin does not establish deployment on your handset.
Do not test with a phone you rely on
Install supported updates and ask the manufacturer or fleet administrator to confirm the fix for an older model. Do not download the demonstration APK to test a daily-use handset, or send test messages to someone else’s number.
If calls or booting repeatedly fail, use another device for urgent communications and seek help. The research describes a technical recovery path; that is not a reason to prescribe a factory reset or deletion of telephony data to every reader. A clean-looking inbox alone does not rule out this scenario.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.