Vulnerability in Android called "SMS of Death"

A vulnerability in Android, known as "SMS of Death," allows a smartphone to crash remotely with a single invisible SMS message. This flaw can also disrupt emergency calls and has been identified in the core telephony component of the Android operating system.

Security researcher reported the flaw to Google

The vulnerability was reported to Google on May 5, 2026, by a security researcher who detailed the issue in a GitHub repository. The information was made public on October 29, and freely downloadable attack code was also released.

Google released a fix in October update

Google published a fix in the October 2026 security update, but only the latest versions of Android (14 to 17) benefit from it. Earlier versions, such as Android 12 and 13, remain vulnerable and are no longer receiving updates.

Flaw stems from how Android handles WAP Push SMS

The flaw comes from the way Android reads a specific category of SMS called WAP Push. These messages are used to transmit information behind the scenes, such as the arrival of an MMS. Android reads the header of each message, which states its size, without performing any checks.

Attack exploits incorrect size calculation

A trapped message of just a few bytes announces an exaggerated size, which, when converted by Android, becomes a negative number. The system then tries to reserve a negative-sized space in memory, which is impossible. This causes the call and network service, com.android.phone, to crash.

Zero-click attack requires only the victim’s phone number

The attack is classified as "zero-click," meaning the victim has no action required. There is no link to click or attachment to open. The attacker only needs the victim’s phone number, and the message does not appear in the Messages app. The sender remains hidden.

Attack can cause repeated crashes and device loops

During testing, a single SMS caused intermittent outages for up to a week. Approximately twenty sends made the device completely unusable for a long time. The trapped message remains pending and replays every time the device starts, potentially causing the smartphone to restart in a loop every 90 seconds.

Victim must use ADB to remove the message

To escape the loop without losing data, the victim must connect the phone to a computer and delete the faulty messages using ADB, a developer tool. This must be done within a short window following each startup. Otherwise, a factory reset may be necessary.

Australian regulations could be exploited by attackers

In Australia, regulations require mobile operators to disconnect devices that cannot call 000, the local emergency number. This rule could be exploited by attackers using trapped SMS messages to ban the victim’s phone from the network, potentially leading to a service block.

Fix only applies to newer Android versions

The fix, written by an engineer on June 15, 2026, was included in the October security update. However, it only applies to Android 14 to 17. Older versions, such as Android 12 and 13, are not protected and remain vulnerable.

Attack code gained popularity on GitHub

The researcher published all attack code on GitHub, and within two days of its release, the project had over 300 stars and 71 forks. The ready-to-use application makes it easy for others to exploit the vulnerability.

Users should check for October 2026 security patch

To ensure their device is protected, users should check their phone’s security patch level. It should indicate October 2026 or more recent. If a phone no longer receives updates, it may be time to consider replacing it.