A researcher known as Mark B has published a public writeup of the Android SMS of Death bug, a zero-click flaw that can crash a phone’s telephony process with one silent text message. The recipient never sees the message, and the writeup says the fix has reached only Android 14 through 17.
If your phone runs an older Android version or an old patch level, this is worth five minutes today. The bug does not steal anything, but it can drop calls, including emergency calls, and knock a phone offline until the queued messages are cleared.
TL;DR: The Android SMS of Death bug lets a crafted, invisible text message crash the phone app process on affected Android phones. The researcher says Android 12 through 17 are affected and that the October 2026 security release fixes Android 14 through 17. Android 12 and 13 do not get the fix. Check your security patch level and install updates.
What the Android SMS of Death bug does
The flaw sits in WapPushOverSms, the part of Android’s telephony code that reads WAP Push messages. According to the researcher’s writeup, a header length is read as a long number, cast to an int without a range check, and then used as an array size. A crafted value turns that size negative, which throws an uncaught exception and kills com.android.phone.
Because the message arrives silently, nothing appears in your inbox. The writeup says calls drop while the process restarts, including emergency calls, and that each message costs roughly one to two seconds of no service.
The harder part is the repeat behavior. The researcher reports that carrier redelivery can re-trigger the crash, with intermittent outages lasting up to a week in his testing, and that a phone can keep crashing at boot until the queued messages are cleared. He tested a Pixel 9 on April 2026 firmware plus several Samsung Galaxy and A-series phones, and reports a 100% reproduction rate. Those are his figures, and DigitBin has not reproduced them. Who gets protected is a separate question.
Which Android versions have the fix
The writeup says Android 12 through 17 are affected, with reproduction reported from Android 12 up to Android 16. It says the fix shipped in the October 2026 security release for Android 14 through 17, while Android 12 and 13 do not receive it. DigitBin could not check that against Google’s October bulletin, so treat the version split as the researcher’s account.
Google’s own change is visible in the Android source. A commit to the telephony code, authored on June 15, 2026, is titled “Fix remote DoS in decodeWapPdu.” It widens the exception handling in decodeWapPdu and marks a failing message as deleted so it is not retried forever.
That is a different approach from the bounds check the researcher proposed, according to his writeup. It stops the crash loop rather than rejecting the bad header up front. For most people the difference will not matter, as long as the patch actually lands on their phone.
From report to public disclosure
The researcher reported the bug on May 5, 2026, through the Android and Devices Vulnerability Reward Program. Google’s commit followed on June 15, and the writeup went public on October 29, 2026, about six months after the first report.
A fix that waits months in the source tree before reaching phones is a familiar Android story, and it falls hardest on handsets whose makers ship patches late. The slow Android 17 rollout is a reminder of how uneven that delivery can be.
What to check on your phone today
Open Settings and look for the Android security update date, which sits in a slightly different place on each maker’s software. A patch level of October 2026 or later should cover Android 14 through 17, going by the writeup.
If you are on Android 12 or 13, there is no fix to wait for, per the researcher. That is a good moment to think about the phone’s remaining life. If a phone is already stuck crashing at boot, the writeup describes a recovery route and advises against choosing wipe data at the recovery prompt, so read it before you reset anything.
