A Single Malformed WAP Push Text Crashes Android's Phone Service and Can Drop Calls, Including Emergency Calls, With No Tap From the Victim

Chris holding a cracking, darkened phone at arm's length as a broken-handset dropped-call symbol floats off it, surrounded by molded warning placards. — Illustration: LockerGnome

WAP Push is a nearly forgotten corner of SMS, a header meant to push a link or a configuration to a phone, delivered as a silent data message rather than a text you read. According to the disclosure writeup published October 29 by a researcher credited as Mark B, a specially malformed WAP Push message makes Android’s telephony framework miscalculate the size of a buffer and crash.

The mechanism is a classic integer bug. The telephony code reads a length field from the message as a large number and converts it to a signed 32-bit integer without checking its range, and an out-of-range value wraps around to a large negative number. Android then tries to allocate an array of that negative size, which throws an uncaught NegativeArraySizeException on the telephony thread and kills the process named com.android.phone. The writeup pins it to a single unchecked conversion in WapPushOverSms, Android’s code for decoding these messages.

Because the message is delivered as silent data, nothing shows up in the inbox and the sender’s number is never displayed. The writeup describes the result as “zero-click” and “silent,” with a one-to-two-second telephony blackout each time the phone service restarts, and it notes that an active voice call ends when the process dies.

The part that turns a crash into a lasting problem is redelivery. The writeup reports that carriers re-send messages the phone never acknowledged, so the poison message arrives again and crashes the service again, and that in testing a single message caused intermittent outages “for up to a week,” while a larger number of them rendered a device unusable for an extended period. It also reports the message can sit queued and re-crash the phone on each boot until it is cleared.

The researcher’s stated concern is emergency calling. The writeup argues that while a device is under this condition it cannot reliably reach emergency services, and it leans on Australian rules that treat emergency-call access as a mandatory property of a mobile service. The uncomfortable twist it raises is regulatory: the official remedy for a handset that cannot reach emergency services is to bar it from the carrier network, so an attacker who can force that state remotely could, in effect, get a victim’s own phone cut off until it is fixed.

Why it matters

Old protocols are still live attack surface. WAP Push dates to the era of feature-phone browsing, and almost no one thinks about it, yet the code that parses it still runs on current Android phones and still handles untrusted input from the network. The least-watched corners are exactly where an unchecked cast survives for years.

A missing bounds check is still one of the most dangerous lines in software. The whole failure is a length field trusted without a range check before it becomes an array size. That same shape, read a number, use it as a size, skip the validation, has caused crashes and worse for decades, and it keeps shipping.

The patch gap is the practical risk, not the exploit. The flaw reaches Android 12 through 17, but the October 2026 fix landed for 14 through 17 only. Phones on 12 and 13, which are plentiful and often past their update window, run the vulnerable code with no fix coming. For a lot of people the exposure is decided by how old their phone is.

How Google fixed it is itself notable. The writeup says the researcher supplied a bounds check on the length, but the shipped fix instead catches the broader runtime exception so the crash is swallowed, and deletes the triggering message so it cannot re-crash the device on redelivery or on boot. That stops the denial of service, and it is in the October 2026 Android security update. The researcher has published a writeup and a proof-of-concept app.

Steal this

Steal this

Update now, and check which Android version you are actually on. Open Settings, find your Android version and security patch level, and confirm you are on the October 2026 update or later. Like checking the expiration date on something in the back of the fridge, it takes ten seconds and tells you whether you have a problem.
If your phone is stuck on Android 12 or 13 with no more updates, treat that as the real finding. No patch is coming for those versions. Plan a replacement, or ask your carrier whether it filters malformed WAP Push traffic on the network, the way you would stop trusting a lock whose maker has stopped making keys.
For anything that reads a length and then allocates, validate before you trust. The entire bug is a size used without a range check. When you take a number off the wire and turn it into a buffer size, bound it first, every time, no matter how obscure the format feels.

The open thread is the long tail. Current phones get the patch, but a flaw that reaches back to Android 12 lands on an enormous base of devices that stopped getting updates years ago, and no amount of fixing the newest releases reaches them. What carriers choose to filter upstream may end up mattering more than the patch for the phones that need it most.

Search

A Single Malformed WAP Push Text Crashes Android's Phone Service and Can Drop Calls, Including Emergency Calls, With No Tap From the Victim

More Security