Ethical Hacking News
A critical vulnerability known as the "SMS of Death" has been discovered in Android's WAP Push system. This vulnerability allows an attacker to crash the phone service, interrupt emergency calls, and even render the device unusable. To stay safe, it's essential to keep the Android operating system up to date and to be aware of the latest security patches.
Android's WAP Push system has a critical vulnerability known as the "SMS of Death" that can crash phone services and render devices unusable. The vulnerability is a zero-click attack, meaning no action is required from the recipient to trigger it. The vulnerability is caused by a mistake in the handling of a numeric value used during message interpretation. Attackers can send a specially crafted WAP Push message to trigger the vulnerability, resulting in a temporary loss of connectivity and disruptions to phone services. The vulnerability affects Android versions 12 to 17 and has been fixed via the October 2026 security update for Android 14, 15, 16, and 17. Keeping software up to date and being aware of the latest security patches is essential to mitigate this risk.
The world of cybersecurity is constantly evolving, and new vulnerabilities are emerging all the time. Recently, a critical vulnerability known as the "SMS of Death" has been discovered in Android's WAP Push system. This vulnerability allows an attacker to crash the phone service, interrupt emergency calls, and even render the device unusable.
The SMS of Death is a zero-click attack, meaning that the recipient does not have to open the message or take any action to trigger the vulnerability. The attacker can send a specially crafted WAP Push message, which is then processed by the Android operating system. This causes the "com.android.phone" process to terminate, resulting in a temporary loss of connectivity and disruptions to phone services.
The vulnerability is caused by a mistake in the handling of a numeric value used during message interpretation. Specifically, the "decodeWapPdu()" function reads the length of the WSP header through a value encoded as "uintvar", which is initially returned as a 64-bit number. However, this value is subsequently converted to a 32-bit integer without prior range checking, resulting in a "NegativeArraySizeException" exception.
The researcher who discovered the vulnerability, Mark Blaszczyk, demonstrated that a five-byte WSP header can generate the value "-2147483648", which is sufficient to trigger the issue. This means that an attacker can send a single message to trigger the vulnerability, making it a significant threat to phone service availability.
The SMS of Death has been tested on several devices, including the Google Pixel 9 and Samsung smartphones from the Galaxy and Galaxy A families. The vulnerable code appears to be present on Android versions ranging from Android 12 to Android 17. However, the availability of the fix is not uniform across all generations of the operating system.
Google has distributed a fix via the October 2026 security update for Android 14, 15, 16, and 17. Older devices, such as those running Android 12 and 13, may remain exposed if they do not receive corrective updates.
This vulnerability highlights the importance of keeping software up to date and being aware of the latest security patches. It also shows that a cyberattack doesn't necessarily have to involve information theft, code execution, or device control to have significant consequences.
In conclusion, the SMS of Death is a critical vulnerability in Android's WAP Push system that can cause significant disruptions to phone services. It is essential to keep the Android operating system up to date and to be aware of the latest security patches to mitigate this risk.
Related Information:
https://www.ethicalhackingnews.com/articles/The-SMS-of-Death-A-Critical-Vulnerability-in-Androids-WAP-Push-System-ehn.shtml
https://securityaffairs.com/202184/security/sms-of-death-android-under-attack-an-invisible-sms-can-block-calls-and-emergency-services.html
https://cybernews.com/security/android-sms-of-death-critical-vulnerability/
Published: Sun Nov 1 08:26:05 2026 by llama3.2 3B Q4_K_M
