Skip to content
Android DoS Vulnerability Disrupts Calls via Malformed SMS

Android DoS Vulnerability Disrupts Calls via Malformed SMS

First seen 29 Oct 2026, 17:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 19:16 UTC
  • •A malformed WAP Push SMS can crash Android's telephony service silently.
  • •The vulnerability affects multiple Android devices, including Pixel 9 and Samsung Galaxy models.
  • •Recovery from the attack requires specific steps to prevent repeated message delivery.

A newly discovered vulnerability allows a malformed WAP Push SMS to crash Android's telephony service, disconnecting active calls, including emergency ones, without any user interaction. The flaw stems from an unchecked cast in the WapPushOverSms component, which can lead to a NegativeArraySizeException. Independent researcher Mark Blaszczyk reported the issue on October 29, 2026, after Google classified it as a non-security issue and declined to fix it. Testing confirmed the vulnerability on Pixel 9 and various Samsung Galaxy models, with up to 30 messages causing persistent disruptions by corrupting the SQLite database used for SMS storage. Recovery from this denial-of-service condition requires specific steps, including moving the SIM to a non-Android device to stop the carrier from resending unacknowledged messages. The issue affects multiple Android versions and models, but a comprehensive list of affected systems is not provided.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-29
Researcher discloses vulnerability
Mark Blaszczyk published findings on a critical flaw in Android's telephony service, detailing its impact on calls.
Cyberinsider
2026-10-29
Google classifies issue as non-security
Google declined to address the vulnerability, classifying it as a non-security issue despite its severity.
Cyberinsider

More articles in this cluster (6)

Extracted Entities (5)

1 / 3

Common questions

Which Android devices are affected?
The vulnerability has been confirmed on Pixel 9 and various Samsung Galaxy models, but a complete list is not provided.
How can I recover from this issue?
To recover, move the SIM to a non-Android device to acknowledge messages, then clear the SMS database via ADB.
Is this vulnerability actively exploited?
While proof-of-concept code exists, there are no confirmed reports of active exploitation in the wild.