# Zero-Click Android DoS Vulnerability via Malformed WAP Push SMS A critical telephony crash vulnerability enables remote, persistent denial of service on Android devices. - **Source:** [Hacker News](https://news.ycombinator.com) - **Published:** 2026-10-29 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/07b08d9e-8f95-461a-accf-87b2ffb3be78 ## Vulnerability Mechanism Explained The flaw resides in WapPushOverSms.java, where a WSP header length is read as a long and cast to an int without bounds checking. This allows a malformed 5-byte uintvar to trigger a NegativeArraySizeException. Consequently, the telephony process crashes, effectively dropping all active calls, including critical emergency service connections. ## Zero-Click Remote Execution This attack requires zero user interaction, as the malformed WAP Push message is delivered silently as a data SMS. The victim never sees an inbox notification or the sender's number. Testing across multiple models, including Pixel 9 and Samsung Galaxy series, confirms a 100% reproduction rate for this transient outage. ## Persistent Database Corruption Rapidly sending approximately 30 payloads creates a race condition that corrupts the SQLite database responsible for storing SMS messages. Once corrupted, the telephony process fails during every boot cycle. This renders the device persistently unable to access cellular services, as the system crashes immediately upon attempting to read the damaged store. ## Hostile Recovery Challenges Recovery is exceptionally difficult because a factory reset provides only temporary relief. Carriers often re-send the unacknowledged payload, immediately re-triggering the crash loop. For users with eSIMs, where physical SIM removal is impossible, the device becomes effectively bricked, requiring advanced technical intervention that remains largely inaccessible to the average consumer. ## Emergency Service Impact The vulnerability directly prevents users from reaching emergency services like 000. By inducing a state where the device cannot place calls, the attack creates a public safety failure. This is not merely a software bug but a functional denial of access to essential infrastructure, posing significant risks to user safety. ## Regulatory Consequences and Barring Australian regulations, specifically the Telecommunications Emergency Call Service Determination, mandate that carriers block devices unable to reach emergency services. Paradoxically, this vulnerability allows an attacker to force a carrier to bar the victim's device from the network. The regulatory remedy for a broken phone is network disconnection, not an OS patch. ## Google VRP Triage Failure The vulnerability was reported through the Android Google Devices VRP, but Google classified it as a non-security issue across three separate tickets. Despite providing a clear fix involving a simple range check before the integer cast, the issue remained unaddressed beyond the 90-day disclosure window, necessitating public release of the findings. ## Security Research Implications The public disclosure includes a proof-of-concept to assist OEMs and carriers in assessing risk. This case highlights the dangers of ignoring low-level telephony bugs that bypass user interaction. Security professionals must now account for persistent DoS vectors that exploit regulatory frameworks to effectively brick devices through forced network service barring. ## Sources covering this story - https://smsofdeath.com/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._