Android 'SMS of Death' Flaw Can Crash Phones With No Click

Independent security researcher Mark Blaszczyk has published details of a zero-click Android vulnerability nicknamed the "SMS of Death". A specially crafted text message can repeatedly crash the phone's telephony service without the victim doing anything. Google has already fixed the bug, so up-to-date devices are not at risk.

How the bug works

The flaw sits in an older Android component that handles a legacy "data SMS" format, historically used for MMS notifications and push content. These messages never appear on screen and are processed in the background. According to the researcher, Android reads a message header length as a long integer and converts it to a signed 32-bit integer without checking that the value is plausible.

With the five-byte sequence 88 80 80 80 00, the value becomes -2147483648. Android then tries to create a byte array of that negative size, which kills the com.android.phone process responsible for telephony. Each malformed message cuts service for one to two seconds while the process restarts, which also drops calls in progress.

The attacker only needs the target's phone number. The message shows up neither in the inbox nor in notifications.

From brief outage to unusable phone

A single message causes a short interruption, but an attacker can send as many as they like. Blaszczyk says one message can trigger intermittent outages lasting up to a week, and twenty can leave a device unusable for longer. Around thirty messages sent in quick succession can corrupt the SQLite database that stores SMS, after which the phone may crash at every startup with no new message needed.

A factory reset may not help, since the attacker can simply resend the message. The researcher's only suggested remedy is to remove the physical SIM, insert it in a non-Android phone and delete the corrupted messages. With an eSIM, that is nearly impossible.

Patched, with no known abuse

Blaszczyk reported the issue to Google on 5 May through the Android and Devices Vulnerability Reward Program. Google first classed it as a non-security issue and judged the severity too low. A fix was developed on 15 June 2026 and shipped in the October 2026 Android security update for Android 14 through Android 17.

The flaw cannot steal data, install spyware or take control of a device. It is a denial-of-service attack that can block calls and mobile network use. The most serious concern is emergency calls. No exploitation in the wild has been observed so far.