Android handsets can be pushed off the cellular network by a single text that never appears in the inbox. Researcher Mark Blaszczyk documented the issue, dubbed SMS of Death, and it needs nothing from the recipient.
The payload is a WAP Push message, a binary SMS that the operating system parses automatically. It rides port 2948, never shows a notification, and hides the sender’s number from the conversation view.
A number that turns negative
The flaw sits in WapPushOverSms, the framework component that interprets these messages. Its decodeWapPdu() function reads a header length as a 64-bit value, then narrows it to 32 bits without checking the range. A five-byte header decoding to 0x80000000 becomes -2147483648, and Android tries to allocate an array of that size.
The resulting NegativeArraySizeException goes uncaught on the telephony main thread. The com.android.phone process dies and restarts, dropping connectivity and cutting active calls. Each crash costs one to two seconds.
Where it becomes serious
Repeated delivery is the real danger. A sustained stream turns a brief hiccup into a persistent denial of service, and calls to emergency services fail along with everything else.
Blaszczyk published working evidence alongside the analysis. No CVE identifier or vendor patch has appeared so far, and it is unclear how much control a carrier has over filtering the malformed messages before they reach a device.
Defenders should watch for WAP Push traffic anomalies on the network side. On the endpoint, the only durable answer is an Android update that bounds the header length before the allocation happens.
