GoKawiilAndroid bug lets a single SMS crash phone app and drop calls
Researcher Mark Blaszczyk disclosed a flaw in Android's telephony stack where a malformed WAP Push SMS causes an unchecked integer cast to produce a negative array size, triggering an uncaught exception that kills the com.android.phone process. The crash requires no interaction from the recipient and can terminate active calls, including emergency calls. Google classified the report as non-security and marked it won't fix, so no CVE was issued despite the 90-day disclosure window elapsing.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the flaw sits in low-level SMS parsing rather than an app, any device running affected Android code could be silently disrupted by a single crafted message, which researchers may view as more serious than Google's 'non-security' classification suggests, especially given the emergency-call impact. Google's refusal to fix it could leave the exploit publicly available and usable against unpatched devices indefinitely, since no patch or tracking identifier exists to coordinate a fix.
- A malformed WAP Push SMS can crash Android's phone process with zero user interaction.
- The bug can terminate active calls, including emergency calls, during the crash.
- Google rated the report as non-security and won't fix, so no CVE was assigned.
Source: smsofdeath.com — Mark Blaszczyk, 2026-10-29
Published there as: “Zero click, silent, remote Android DoS”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.