EN PT-BR
← Voltar ao feed
critical

"SMS of Death" zero-click Android flaw (CVE-2026-58882): malformed WAP Push SMS crashes telephony, public PoC, Critical in November 2026 bulletin

4 fonte(s) · 6 atualização(ões) · publicado 30/10/2026 02:08 · coletado há 15 horas

Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 05/11/2026 00:06; os links antigos trazem para cá.

Fontes: gbhackers.com ×2 ↗ securityaffairs.com ×2 ↗ thehackernews.com ↗ bleepingcomputer.com ↗

A zero-click denial-of-service flaw in Android dubbed SMS of Death (tracked as CVE-2026-58882 per bleepingcomputer.com) lets a single malformed WAP Push SMS repeatedly crash the com.android.phone telephony process. The message arrives silently on SMS port 2948, never appears in the inbox or reveals the sender, and can drop active calls, including emergency calls (gbhackers.com). The researcher, credited as Mark B (gbhackers.com, securityaffairs.com), Mark Blah (bleepingcomputer.com) or Mark Blaszczyk (securityaffairs.com), reported it to Google's Android and Devices Vulnerability Reward Program on 5 May 2026 and disclosed it publicly on 29 October 2026; a working proof of concept is now public (bleepingcomputer.com). Google fixed it in the October 2026 Android security update for Android 14 through 17. securityaffairs.com (1 November and 4 November) reports the CVE is rated Critical in the November 2026 Android Security Bulletin, while bleepingcomputer.com (31 October) had reported it absent from the October bulletin; thehackernews.com (4 November) confirms the Critical rating in the November bulletin and notes that neither the bulletin nor the CVE record states whether CVE-2026-58882 is the same bug described in the public "SMS of Death" write-up (securityaffairs.com on 4 November says the same, while noting the vulnerable function overlaps). thehackernews.com also reports that, as of November 4, Google's bulletin lists no active exploitation of the flaw and it is not included in CISA's Known Exploited Vulnerabilities catalog as of November 3. Android 12 and 13 remain unpatched unless vendors issue updates. The researcher reproduced it on a Pixel 9 (April 2026 firmware) and several Samsung Galaxy and Galaxy A devices, observing intermittent outages of up to a week from one message (gbhackers.com, securityaffairs.com). The vulnerable code appears present from Android 12 to 17 (securityaffairs.com). No code execution or data theft was demonstrated. A quoted post cited by securityaffairs.com says a custom Android build has included the patch in its security preview releases since build 2026072901.

The November 2026 bulletin, published on November 2 (gbhackers.com), is much broader than this flaw: it fixes 216 vulnerabilities, including 23 Critical (securityaffairs.com). Its headline issue is the separate zero-click RCE CVE-2026-58868 in the Android Framework (Android 14-17), and securityaffairs.com says Google is aware of active exploitation related to flaws covered in the bulletin (see Conflicting Reports).

Entenda a falha

A vulnerabilidade

CVE-2026-58868, the most severe in the November 2026 bulletin, is a heap buffer overflow (out-of-bounds write) in onOutputReceived in FrameDecoder.cpp, Framework, Android 14 to 17. It allows remote code execution with no privileges and no user interaction. The story centers on CVE-2026-58882, "SMS of Death", rated Critical in the bulletin: a zero-click remote DoS in WapPushOverSms.decodeWapPdu. The attacker needs only the victim's phone number and sends one malformed WAP Push SMS, which crashes com.android.phone and drops calls, including emergency calls. The code is present from Android 12 to 17; the fix covers Android 14 to 17, while 12 and 13 stay unpatched. Also fixed: CVE-2026-58876, CVE-2026-58936 (System RCEs), CVE-2026-25285 (Qualcomm), the MediaTek modem flaws and CVE-2026-58988.

Como funciona

For CVE-2026-58882, a WAP Push data SMS arrives on port 2948 and Android processes it before it reaches the inbox, so the user sees nothing. decodeWapPdu reads the Wireless Session Protocol header length as a variable-length integer (uintvar) returned as a long, then casts it to a signed 32-bit int. A large value becomes negative, and the code uses it to allocate a byte array. That throws an uncaught NegativeArraySizeException on the telephony main thread and kills com.android.phone, costing one to two seconds of service per crash. Carrier redelivery and messages stuck in the pending inbound queue re-trigger it after reboot, causing a crash loop. For CVE-2026-58868, Google does not say how the vulnerable code is reached.

Por que é vulnerável

CVE-2026-58882 is a missing range check: the header length is narrowed from long to int without validation, so an oversized value turns negative and is used as an array size. The exception is also not handled in the processing path, so one bad message kills the telephony process, and the message is reprocessed. Google's fix, "Fix remote DoS in decodeWapPdu", broadens exception handling for runtime failures and deletes the triggering messages from the SMS database. It does not add the header-length bounds check the researcher proposed. For CVE-2026-58868, Google does not disclose the root cause beyond the heap overflow. MediaTek attributes its flaws to missing bounds checks, integer overflow or improper input validation.

Onde está

CVE-2026-58882 is in WapPushOverSms.decodeWapPdu(), in frameworks/opt/telephony; the fix is titled "Fix remote DoS in decodeWapPdu" (no commit cited). CVE-2026-58868 is in onOutputReceived in FrameDecoder.cpp (A-486464711).

Como foi descoberta

The researcher, credited as Mark B (also Mark Blah or Mark Blaszczyk; probably the same person), reported SMS of Death to Google's Android and Devices Vulnerability Reward Program on 5 May 2026 and published the write-up on 29 October. Tests reproduced it on a Pixel 9 (April 2026 firmware) and several Samsung Galaxy devices; a GitHub contributor, Sakis, found a way to purge the messages with ADB. A custom Android build says it has carried the patch since build 2026072901. Google's bulletin and the CVE record do not confirm that CVE-2026-58882 is the same bug, though the function overlaps. The bulletin lists no exploitation of it, and it was not in CISA's KEV as of 3 November. The articles do not say who found CVE-2026-58868.

PoC pública

According to BleepingComputer, the researcher published a working proof of concept for SMS of Death: an app that sends the malicious message from one Android device to another. It reproduces the crash and, in the researcher's tests, repeated crashes and reboot loops with about 20 messages. It is a DoS exploit, with no code execution or data theft shown. Since it is public and needs only the target's phone number, patching Android 14 to 17 is urgent. Android 12 and 13 stay exposed, and use should be limited to authorized testing because emergency calls can be disrupted.

Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 00:22.

Detalhes técnicos

  • The bug is in WapPushOverSms.decodeWapPdu(). The Wireless Session Protocol header length is read as a variable-length unsigned integer returned as a long, then cast to a signed 32-bit int without range validation (gbhackers.com). The resulting value is -2147483648 (bleepingcomputer.com). A five-byte uintvar 88 80 80 80 00 decodes to 0x80000000 (securityaffairs.com).
  • The negative value is used to allocate a byte array, raising an uncaught NegativeArraySizeException on the main telephony thread and killing com.android.phone. Each crash costs one to two seconds of telephony service (gbhackers.com, securityaffairs.com).
  • The trigger is an eight-byte WAP Push (01 06 88 80 80 80 00 BE) sent as a data SMS to port 2948. Android processes it before it reaches the inbox, so the victim sees no sign of it (bleepingcomputer.com). The PoC can send the messages from another Android device (bleepingcomputer.com).
  • Carrier redelivery of unacknowledged messages amplifies the outage. Messages stuck in the pending inbound SMS queue can re-trigger crashes after reboot (gbhackers.com, bleepingcomputer.com, securityaffairs.com). securityaffairs.com (4 November) describes the device retrying the malicious message on every reboot, causing a persistent crash loop.
  • About 20 messages caused extended unusability and reboot loops, and the phone process can keep crashing at startup. One Android 12 device rebooted into recovery mode roughly every 90 seconds (both sources).
  • A GitHub contributor, Sakis, found a way to purge the malicious messages with ADB, which requires a computer and advanced knowledge (bleepingcomputer.com, securityaffairs.com).
  • thehackernews.com (4 November) describes CVE-2026-58882 generically as a remote DoS in decodeWapPdu, in Android's code for WAP Push messages arriving via SMS, without adding new technical detail beyond confirming the Critical rating.
  • Other flaws in the November 2026 bulletin (context, not part of SMS of Death):
    • CVE-2026-58868 is a heap buffer overflow (out-of-bounds write) in the onOutputReceived function of FrameDecoder.cpp, affecting Android 14 through 17. It allows remote code execution with no user interaction and no additional privileges, a potential zero-click exploit (securityaffairs.com). gbhackers.com lists the affected Framework versions as Android 14, 15, 16, 16-QPR2 and 17.
    • Two further Critical System-component RCE flaws, CVE-2026-58876 and CVE-2026-58936, are patched (securityaffairs.com, gbhackers.com). CVE-2026-58876 can also be remediated through a Google Play system update (Project Mainline) for Media Codecs, in addition to a platform patch (gbhackers.com).
    • The bulletin also fixes six Critical kernel flaws (Bluetooth, pKVM, HID), eight Critical MediaTek modem vulnerabilities and one Critical closed-source Qualcomm component flaw, CVE-2026-25285 (securityaffairs.com). MediaTek's own bulletin details six of the eight (CVE-2026-20499, CVE-2026-20545 through CVE-2026-20549) as out-of-bounds write issues from missing bounds checks, integer overflow or improper input validation, and MediaTek says it is not aware of active exploitation of these specific flaws (securityaffairs.com).
    • CVE-2026-58988 is a high-severity Android runtime information-disclosure flaw, exploitable without user interaction or extra privileges (gbhackers.com).
    • gbhackers.com says Google has not disclosed the root cause, exploit delivery mechanism or vulnerable interface for the Framework/System RCE flaws, stating only that the Critical rating assumes platform mitigations are disabled or bypassed.

Remediação

  • Install the manufacturer's October 2026 Android security update or later, including the November 2026 bulletin where available. Availability depends on the manufacturer and carrier, and a restart may be needed to complete installation (bleepingcomputer.com, securityaffairs.com).
  • Security patch level 2026-11-01 or later covers the Critical Framework and System RCE issues. Patch level 2026-11-05 adds kernel, modem, GPU and vendor-specific fixes, including the MediaTek and Qualcomm issues. Verify the device's patch level rather than relying on the Android version number alone, and aim for 2026-11-05 or later (securityaffairs.com, gbhackers.com). Rollout timing depends on manufacturers and carriers (securityaffairs.com).
  • Google's fix, "Fix remote DoS in decodeWapPdu", broadens exception handling for runtime failures and deletes the triggering messages from the SMS database to prevent reprocessing. It does not apply the researcher's proposed header-length bounds check (gbhackers.com, bleepingcomputer.com).
  • Owners of Android 12 and 13 devices should check with their vendor and replace or isolate unsupported devices (bleepingcomputer.com, securityaffairs.com).
  • Restrict use of the published PoC to explicitly authorized testing, since disruption can affect emergency communications (gbhackers.com).
  • The November 2026 bulletin provides no workaround for devices unable to install the update yet (thehackernews.com). gbhackers.com notes Google Play Protect and Android Advanced Protection provide additional defense-in-depth.

Relatos divergentes

  • Researcher name: Mark B (gbhackers.com, and securityaffairs.com in its 4 November article), Mark Blah (bleepingcomputer.com) and Mark Blaszczyk (securityaffairs.com, which also uses "Mark Blah" in its body); probably the same person. The fullest form is Mark Blaszczyk, but it is not confirmed.
  • CVE: only bleepingcomputer.com and securityaffairs.com give CVE-2026-58882; gbhackers.com assigns none. thehackernews.com (4 November) uses the same CVE but notes neither Google's bulletin nor the CVE record confirms this is the "SMS of Death" bug. securityaffairs.com (4 November) agrees the bulletin does not explicitly confirm it, though the vulnerable function overlaps.
  • Bulletin listing: bleepingcomputer.com (31 October) says the flaw is not listed in the October bulletin. securityaffairs.com (1 and 4 November) and thehackernews.com (4 November) agree it is rated Critical in the November 2026 bulletin. Treat the later reports as more current.
  • Patch scope: gbhackers.com says the fix covers Android 14-17. bleepingcomputer.com adds that Android 12/13 devices are unpatched. securityaffairs.com agrees that Android 12 and 13 may stay exposed without updates.
  • Android 12 recovery: gbhackers.com says one Android 12 case was cleaned up via ADB without a factory reset. bleepingcomputer.com says an Android 12 device in a recovery-mode reboot loop required a factory reset. These may be different cases.
  • Exploitation status: thehackernews.com (4 November) reports no active exploitation of CVE-2026-58882 per Google's bulletin and no listing in CISA's KEV catalog as of November 3. securityaffairs.com (4 November) says Google states it is aware of active exploitation "related to flaws covered in this bulletin" without tying it to a specific CVE. The two are not necessarily contradictory (bulletin-wide versus this flaw), but no source links exploitation to CVE-2026-58882; the thehackernews.com statement is the most specific one for this flaw.
  • Disclosure of root causes: securityaffairs.com (4 November) gives a specific location for CVE-2026-58868 (onOutputReceived in FrameDecoder.cpp), while gbhackers.com (4 November) says Google has not disclosed the root cause or vulnerable interface for the Framework/System RCE flaws. Which is more accurate is unresolved.

Linha do tempo

  1. gbhackers.com ↗ · pub. 04/11/2026 09:14 · coletado 04/11 10:00

    Google's November 2026 Android Bulletin Patches Critical Zero-Click RCE Flaws and Adds Info-Disclosure CVE-2026-58988

    This article adds a previously unreported flaw in the November 2026 bulletin, **CVE-2026-58988**, a high-severity Android runtime information-disclosure vulnerability exploitable without user interaction or extra privileges, and clarifies that **CVE-2026-58876** can also be remediated via a Google Play system update (Project Mainline) for Media Codecs, in addition to a platform patch. It also details the distinction between the 2026-11-01 patch level (Framework/System fixes) and the broader 2026-11-05 level (adds kernel and vendor fixes) (gbhackers.com).

    ler a análise desta fonte

    This article adds a previously unreported flaw in the November 2026 bulletin, CVE-2026-58988, a high-severity Android runtime information-disclosure vulnerability exploitable without user interaction or extra privileges, and clarifies that CVE-2026-58876 can also be remediated via a Google Play system update (Project Mainline) for Media Codecs, in addition to a platform patch. It also details the distinction between the 2026-11-01 patch level (Framework/System fixes) and the broader 2026-11-05 level (adds kernel and vendor fixes) (gbhackers.com).

    Google published its November 2026 Android Security Bulletin on November 2, addressing critical remote-code-execution flaws exploitable without user interaction or additional privileges. The most severe issue, CVE-2026-58868, affects the Android Framework across Android 14, 15, 16, 16-QPR2, and 17. Two further critical System-component RCE flaws, CVE-2026-58876 and CVE-2026-58936, are also patched, with CVE-2026-58876 additionally deliverable via a Google Play system update (Project Mainline). The bulletin also fixes CVE-2026-58988, a high-severity Android runtime information-disclosure flaw requiring no user interaction or extra privileges.

    Technical Details

    Google has not disclosed the underlying root cause, exploit delivery mechanism, or vulnerable interface for these flaws, stating only that the critical rating assumes platform mitigations are disabled or bypassed. Security patch level 2026-11-01 covers the critical Framework and System RCE issues, while the broader 2026-11-05 level adds kernel, modem, GPU, and vendor-specific fixes on top of the earlier requirements.

    Remediation

    Users and administrators should install vendor updates to reach security patch level 2026-11-05 or later and verify the device's patch level rather than relying on the Android version number alone. Google Play Protect and Android Advanced Protection provide additional defense-in-depth.

  2. securityaffairs.com ↗ · pub. 04/11/2026 07:26 · coletado 04/11 08:00

    Google Patches Critical Zero-Click Android RCE Flaw CVE-2026-58868, Fixes 216 Vulnerabilities in November Bulletin

    ler a análise desta fonte

    Google has released its November 2026 Android security bulletin, patching 216 vulnerabilities including 23 Critical flaws. The headline issue, CVE-2026-58868, is a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp affecting Android 14 through 17, allowing remote code execution with no user interaction and no additional privileges — a potential zero-click exploit. Google states it is aware of active exploitation related to flaws covered in this bulletin. The bulletin also addresses two other System-component RCE flaws (CVE-2026-58876, CVE-2026-58936), six Critical kernel flaws (Bluetooth, pKVM, HID), eight Critical MediaTek modem vulnerabilities, and one Critical closed-source Qualcomm component flaw (CVE-2026-25285). Separately, CVE-2026-58882, dubbed "SMS of Death," could let an attacker remotely crash or disable a phone by sending a crafted WAP Push SMS message to decodeWapPdu, potentially terminating active calls including emergency calls and triggering a crash loop.

    Technical Details

    CVE-2026-58868 is caused by an out-of-bounds write due to a heap buffer overflow, enabling remote code execution with no execution privileges or user interaction needed. MediaTek's own bulletin details six of the eight Critical modem flaws (CVE-2026-20499, CVE-2026-20545 through CVE-2026-20549) as out-of-bounds write issues from missing bounds checks, integer overflow, or improper input validation; MediaTek states it is not aware of active exploitation of these specific flaws. For CVE-2026-58882, researcher Mark B published analysis on October 29 showing a malformed WAP Push message can crash com.android.phone, with the device retrying the malicious message on every reboot, causing a persistent crash loop. Google's bulletin does not explicitly confirm CVE-2026-58882 is the same issue as the "SMS of Death" report, though the vulnerable function overlaps.

    Remediation

    Devices receive fixes via security patch level 2026-11-01 or later (patch level 2026-11-05 covers MediaTek and Qualcomm issues), rollout timing depends on device manufacturers and carriers. Users should apply the latest Android security updates as soon as they become available.

  3. thehackernews.com ↗ · pub. 04/11/2026 04:46 · coletado 04/11 07:00

    Google Patches Critical Zero-Click Android RCE Flaw (CVE-2026-58868) Among 216 Fixes in November Bulletin

    The Hacker News (4 November) confirms the November 2026 Android bulletin rates CVE-2026-58882 as Critical, corroborating securityaffairs.com's earlier report, and clarifies that neither the bulletin nor the CVE record states whether CVE-2026-58882 is the same bug described in the "SMS of Death" write-up by Mark B. It also adds that as of November 4 Google reports no active exploitation of any flaw in this bulletin, and none appear in CISA's KEV catalog as of November 3. Separately, the same bulletin discloses an unrelated zero-click Critical RCE flaw, CVE-2026-58868, plus two other Critical RCE bugs (CVE-2026-58876, CVE-2026-58936) and six Critical kernel flaws.

    ler a análise desta fonte

    The Hacker News (4 November) confirms the November 2026 Android bulletin rates CVE-2026-58882 as Critical, corroborating securityaffairs.com's earlier report, and clarifies that neither the bulletin nor the CVE record states whether CVE-2026-58882 is the same bug described in the "SMS of Death" write-up by Mark B. It also adds that as of November 4 Google reports no active exploitation of any flaw in this bulletin, and none appear in CISA's KEV catalog as of November 3. Separately, the same bulletin discloses an unrelated zero-click Critical RCE flaw, CVE-2026-58868, plus two other Critical RCE bugs (CVE-2026-58876, CVE-2026-58936) and six Critical kernel flaws.

    Google's November 2026 Android Security Bulletin patches 216 vulnerabilities, 23 rated Critical, including a zero-click remote code execution flaw tracked as CVE-2026-58868 affecting Android 14 through 17. The flaw is an out-of-bounds write caused by a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp; Google does not disclose how an attacker would reach the vulnerable code. As of November 4, Google reports no active exploitation, and none of the bulletin's flaws appear in CISA's Known Exploited Vulnerabilities catalog as of November 3. The bulletin also covers the previously reported "SMS of Death" denial-of-service flaw (CVE-2026-58882) in decodeWapPdu, two more Critical RCE flaws (CVE-2026-58876, CVE-2026-58936) in the System component, and six Critical kernel flaws, two in Bluetooth code.

    Technical Details

    • CVE-2026-58868: heap buffer overflow / out-of-bounds write in onOutputReceived (FrameDecoder.cpp); fixed with security patch level 2026-11-01 or later.
    • CVE-2026-58882: Critical remote denial-of-service in decodeWapPdu, part of Android's WAP Push SMS handling; the article notes it is unclear whether this is the same bug as the publicly disclosed "SMS of Death" issue.
    • CVE-2026-58876: another Critical flaw, also deliverable via Google Play system updates for devices running Android 10+.
    • CVE-2026-58936: Critical RCE in the Android System component.
    • Six Critical kernel flaws, two affecting Bluetooth; the most severe could allow remote privilege escalation without user interaction.
    • The 2026-11-05 patch level additionally covers Critical flaws in MediaTek modem code and a closed-source Qualcomm component; MediaTek states it is unaware of active exploitation.

    Remediation

    • Check Settings > About phone > Android version for the security patch level; 2026-11-01 or later covers Framework/System/Runtime flaws including CVE-2026-58868, while 2026-11-05 or later is needed for kernel and chipset vendor fixes.
    • Availability depends on device manufacturer and carrier rollout schedules.
    • No workaround exists for devices that cannot yet install the update.
    • Android 12 and 13 are not confirmed as affected or patched for CVE-2026-58868.
  4. securityaffairs.com ↗ · pub. 01/11/2026 09:16 · coletado 01/11 11:00

    SMS of Death: zero-click WAP Push SMS crashes Android telephony (CVE-2026-58882), rated Critical in the November 2026 bulletin

    Securityaffairs.com reports that CVE-2026-58882 is rated Critical in the November 2026 Android Security Bulletin, which was not previously known. A quoted post, apparently from a custom ROM project, says the patch has been in its security preview releases since build 2026072901. The article also gives the researcher's full name as Mark Blaszczyk and states that the vulnerable code spans Android 12 to 17.

    ler a análise desta fonte

    Securityaffairs.com reports that CVE-2026-58882 is rated Critical in the November 2026 Android Security Bulletin, which was not previously known. A quoted post, apparently from a custom ROM project, says the patch has been in its security preview releases since build 2026072901. The article also gives the researcher's full name as Mark Blaszczyk and states that the vulnerable code spans Android 12 to 17.

    A zero-click denial-of-service flaw in Android dubbed SMS of Death lets a single crafted WAP Push message crash the com.android.phone telephony process, interrupting calls including emergency calls. The issue was documented by independent researcher Mark Blaszczyk (also rendered as "Mark Blah" in the article). It is tracked as CVE-2026-58882 and rated Critical in the November 2026 Android Security Bulletin. The message is delivered as a binary data SMS on port 2948, does not appear in the inbox, and needs no user interaction. Repeated processing can cause a persistent outage lasting up to a week or a boot-loop-like state. The researcher reproduced it on the Google Pixel 9 and Samsung Galaxy and Galaxy A devices, with vulnerable code in Android 12 to 17.

    Technical Details

    • The bug is in the WapPushOverSms framework component (frameworks/opt/telephony). decodeWapPdu() reads the WSP header length as a uintvar returned as a 64-bit value, then casts it to a 32-bit integer without a range check.
    • A five-byte uintvar of 88 80 80 80 00 decodes to 0x80000000, which becomes -2147483648 as a signed int. Allocating new byte[-2147483648] throws an uncaught NegativeArraySizeException on the telephony main thread and kills com.android.phone.
    • Each processing causes roughly 1-2 seconds of telephony disruption. The message can stay in the incoming SMS queue and be reprocessed, and carrier retransmission adds further crashes.
    • The researcher saw intermittent crashes for up to a week after one message. About twenty messages can make a device unusable for a long period, and the phone process can crash at startup. Recovery may require ADB to clear the SMS queue.

    Remediation

    • Check the Android security patch level and apply available updates, in particular the November 2026 bulletin.
    • According to the researcher's documentation, Google shipped a fix in the October 2026 update for Android 14, 15, 16 and 17. Android 12 and 13 devices may stay exposed without vendor updates.
    • Pay particular attention to devices that no longer receive manufacturer support.
  5. bleepingcomputer.com ↗ · pub. 31/10/2026 12:35 · coletado 31/10 14:00

    Android 'SMS of Death' zero-click flaw CVE-2026-58882 gets public PoC, can crash phones and cut emergency calls

    ler a análise desta fonte

    A researcher, Mark Blah, has published a proof-of-concept exploit for CVE-2026-58882, dubbed "SMS of Death", a zero-click denial-of-service flaw in Android. A specially crafted WAP Push text message can crash the phone's cellular stack, drop ongoing calls (including emergency calls) and disrupt connectivity. Google reportedly fixed the issue in the October 2026 Android updates for Android 14 through 17, but the flaw is not listed in the October security bulletin, and Android 12 and 13 devices remain unpatched. With a working PoC now public, unpatched devices are exposed to remote disruption without any user interaction.

    Technical Details

    • The bug is an improper validation of a header-length value in WapPushOverSms.decodeWapPdu. The value is converted to a signed 32-bit integer without a bounds check and becomes -2147483648.
    • Allocating memory with this negative value triggers a NegativeArraySizeException that crashes the com.android.phone process, which manages cellular functions.
    • The malicious message is an eight-byte WAP Push (01 06 88 80 80 80 00 BE) sent as a data SMS to port 2948. Android processes it before it reaches the SMS inbox, so the victim sees no indication of the cause.
    • Crashes can repeat when carriers redeliver the message or when Android processes messages already stored on the device. In testing, 20 messages put phones into reboot loops. One Android 12 device rebooted into recovery mode about every 90 seconds and required a factory reset.
    • A GitHub contributor named Sakis found a way to remove the malicious messages with Android Debug Bridge (ADB), but it requires a computer and advanced knowledge.
    • The PoC can send the malicious messages from another Android device.

    Remediation

    • Install the latest Android security updates. Google's fix, "Fix remote DoS in decodeWapPdu", catches the exceptions raised by malformed messages and deletes the malicious messages from the SMS database.
    • Availability depends on the device manufacturer and carrier, and a restart may be needed to complete installation.
    • Android 12 and 13 devices did not receive the fix, so users should check with their vendor, or replace or isolate unsupported devices.
  6. gbhackers.com ↗ · pub. 30/10/2026 02:08 · coletado 30/10 03:00 primeiro registro

    "SMS of Death": zero-click Android flaw crashes telephony process via malformed WAP Push SMS

    ler a análise desta fonte

    A researcher known as Mark B disclosed a zero-click Android denial-of-service flaw dubbed SMS of Death that repeatedly crashes the com.android.phone telephony process using a single malformed WAP Push SMS. The message arrives silently on SMS port 2948, never appearing in the inbox or revealing the sender, and can drop active calls including emergency calls. Reported to Google's Android and Devices Vulnerability Reward Program on 5 May 2026 and publicly disclosed on 29 October 2026, the issue was fixed in the October 2026 Android security update for Android 14 through 17. The researcher reproduced it on a Pixel 9 (April 2026 firmware) and several Samsung Galaxy devices, observing intermittent outages lasting up to a week from a single message and extended unusability after roughly 20 messages. No code execution or data theft was demonstrated.

    Technical Details

    The bug lives in WapPushOverSms.decodeWapPdu() in Android's telephony framework. The Wireless Session Protocol header length is read as a variable-length unsigned integer returned as a long, then cast directly to a signed 32-bit int without range validation. An oversized value becomes negative and is used to allocate a byte array, raising an uncaught NegativeArraySizeException on the main telephony thread and killing com.android.phone. Each crash costs one to two seconds of telephony service, and carrier redelivery of unacknowledged messages amplifies the outage. Messages stuck in Android's pending inbound SMS queue can re-trigger crashes after reboot; one Android 12 case involved repeated recovery-mode reboots, remediated via targeted queue cleanup over ADB without a factory reset.

    Remediation

    Install the manufacturer's October 2026 Android security update or later. Google's fix broadens exception handling for runtime failures and cleans up the triggering messages to prevent reprocessing, rather than applying the researcher's proposed header-length bounds check. Use of the published proof of concept should be restricted to explicitly authorized testing, since disruption can affect emergency communications.