Zero click, silent, remote Android DoS
- ID
- 40875
- Status
- summarized
- Published
- 29 Oct 2026, 3:08 PM
- Fetched
- 30 Oct 2026, 2:36 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://smsofdeath.com/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 6.5
- Created
- 30 Oct 2026, 2:37 AM
- Tags
- Audience
- developerssaas_founders
What happened
An independent write-up documents a zero-click Android telephony DoS via a malformed WAP Push SMS: WapPushOverSms.decodeWapPdu() casts the WSP header length to a signed int without a bounds check, so a 5-byte uintvar of 88 80 80 80 00 becomes -2147483648 and new byte[negative] throws an uncaught NegativeArraySizeException on the telephony main thread. The message is silent and never appears in Messages, but it kills com.android.phone, drops active calls including emergency calls, and causes 1–2 seconds of no service per message; carrier redelivery can re-crash the phone, and about 20 messages can render a device unusable for an extended period. Google marked it Won't Fix and Non-Security, and no CVE was issued.
Why it matters
If you manage Android fleets, SMS ingress, or field-ops/on-call workflows, treat WAP Push data SMS on port 2948 as untrusted and filter or disable it where it is not needed: the crash is silent, drops active calls including emergency calls, and carrier redelivery can turn one message into repeated outages. Do not assume an SMS-based disruption will show up in the user's inbox or be visible to the victim.
Discussion angle
Should a zero-click crash of com.android.phone that can drop emergency calls be classified as Non-Security, and who should own mitigation—Google, OEMs, or carriers filtering WAP Push port 2948?