Android flaw lets invisible SMS block calls and emergency services

Independent researcher Mark Blaszczyk has documented a zero-click SMS-based vulnerability in Android that can crash the device’s phone services and block ongoing calls, including emergency calls, without any user interaction. The attack uses a specially crafted WAP Push message delivered over the network on port 2948.

The message is processed automatically by the OS and can cause the com.android.phone process to terminate, temporarily interrupting voice connectivity and, in repeats, potentially creating a persistent denial-of-service effect.

Blaszczyk’s analysis identifies the flaw in the WapPushOverSms component (frameworks/opt/telephony) where decodeWapPdu() reads a length from a uintvar as a 64-bit value and then casts it to a 32-bit int without proper range checking. This can yield a negative value, leading to Allocation of a negative-sized array and a NegativeArraySizeException on the telephony thread. He demonstrates that just five bytes of WSP header can trigger the issue (for example, 88 80 80 80 00 → 0x80000000 → -2147483648).

The impact is to interrupt calls and potentially render devices unusable for extended periods if multiple messages are processed. Google has issued a fix in the October 2026 security update for Android 14–17; older Android versions (12–13) may remain exposed if not updated. The vulnerability is assigned CVE-2026-58882 and has been described as Critical in the November 2026 Android Security Bulletin.