A newly disclosed vulnerability, dubbed “SMS of Death,” allows attackers to crash a phone's telephony process with a single malformed SMS message This article explores vulnerability dubbed sms. . A specially crafted data SMS sent to port 2948 silently reaches the vulnerable parser, without appearing in the messaging inbox or displaying the sender's number.
Android improperly retrieves this value as a long, casts it to a signed integer without validating its range, and then uses the result to allocate a byte array.
Mark B reports that the process restarts cause active voice calls, including emergency calls, to drop, and briefly interrupt cellular service. Testing has reportedly reproduced the issue on a Pixel 9 running firmware from April 2026 and several Samsung Galaxy devices, although these results do not establish universal exposure across every Android handset. According to the write-up, carriers repeatedly redelivered unacknowledged messages, triggering failures, with one message causing intermittent outages lasting up to a week during testing.
Google's commit, authored on June 15, confirms a fix for persistent crash loops during WAP Push decoding and SMS broadcast processing. A public proof of concept is available, but testing should remain confined to authorized devices due to the risk of disrupting emergency communications without notice.
