Critical Android vulnerability: The message that could disable your phone

A security researcher has revealed a critical zero-click vulnerability in Android that allows attackers to disable cellular services by sending a single text message. The flaw disrupts the internal telephony process, disconnects emergency calls, and can trap smartphones in a crash loop leading to data deletion.

Security researcher Mark Blashchik has uncovered a critical vulnerability in the Android operating system, dubbed 'SMS of Death'. This is a zero-click attack: the victim does not need to click a link or open a file – the malicious message immediately disables cellular services. The root of the issue lies in Android's internal telephony component responsible for processing WAP Push messages. A miscalculation in data field length leads to an internal negative integer overflow error, causing an immediate crash of the telephony process. The attacker can send a burst of about twenty consecutive messages, triggering an infinite crash and reboot loop and data deletion. The vulnerability was detected on Google Pixel and Samsung Galaxy devices, but any device running Android 12 and above is exposed. The researcher reported the issue to Google about six months ago, but the company classified it as a stability flaw rather than a security problem, and only after independent demonstrations were published was a patch developed for Android 14 and above updates. The article provides practical guidance for affected users, including removing the SIM card and connecting to a computer to delete corrupted messages.