A single crafted text message can knock an Android phone off the cellular network, and on some builds it will not come back without a factory reset. The flaw sits in Android's WAP Push handling, and a working proof-of-concept is now public.

What happened

Android processes WAP Push messages, the data SMS carriers use for MMS notifications, inside WapPushOverSms.decodeWapPdu. The header-length field in that message is converted to a signed 32-bit integer with no bounds check. A crafted eight-byte message sent to port 2948 becomes a negative value, Android tries to allocate an array of that size, and the com.android.phone process dies on a NegativeArraySizeException.

That process owns telephony, so the crash drops mobile connectivity and cuts calls in progress, including calls to emergency numbers. The message never lands in the inbox, so there is nothing for the user to see and delete. Google fixed the parsing path in the October 2026 Android security updates for Android 14 to 17 with a change titled "Fix remote DoS in decodeWapPdu", but the fix was not listed in the public October bulletin, and Android 12 and 13 devices did not receive it.

Researcher Mark Blah published the technical analysis and a proof-of-concept on 31 October. In his testing, 20 messages were enough to push a phone into a reboot loop, and one Android 12 handset re-entered recovery roughly every 90 seconds until it was factory reset.

Who is affected

• Android 12 and Android 13 phones and tablets, for which no fix has been published
• Android 14 to 17 devices that have not taken the October 2026 security update
• Handset models where the manufacturer or carrier has not yet shipped that update
• Anyone who relies on a mobile number for on-call contact, emergency calls or two-factor codes

What to do now

Check the security patch level on every business handset and get anything older than October 2026 updated or replaced.

• Open Settings, then About phone, then Android version, and read the security update level. 1 October 2026 or later is the target.
• Push the update through your MDM and flag non-compliant devices until they report the new patch level.
• Plan replacement for Android 12 and 13 handsets used for work, because this fix is not coming to them.
• A phone stuck in a reboot loop can sometimes be cleared by deleting the messages over ADB from a computer, but a factory reset is the realistic outcome, so keep business data in managed apps or backed up.

What this means for South African businesses

Most SMEs here issue Android handsets and then treat them as personal devices until something breaks, so patch levels are rarely checked and MDM coverage is partial. The realistic exposure is availability rather than espionage: one hostile message takes a staff member off the network, and a reboot loop costs the handset and whatever was stored on it. My judgement is that the sharpest risk for a South African SME is the Android 12 and 13 devices still in service on cheap contracts, because no vendor patch is coming and nobody is tracking them.

Source: BleepingComputer - New Android SMS of Death exploit can remotely crash unpatched phones.