Android’s silent SMS crash has a fix. Device rollout is the harder question

A malformed SMS can crash Android’s telephony process without its owner opening a message or tapping a link. The vulnerability disclosed as “SMS of Death” is a denial-of-service problem: it can interrupt calls and, in more persistent cases reported by the researcher, leave a handset repeatedly failing to recover normal service. It is not evidence of an attacker reading messages or taking control of every Android phone.

A fix exists in Android’s source code. The less straightforward question is whether a particular phone has received it. Reports disagree about how to map the change to the October and November security releases, making a blanket assurance about one patch date premature.

A message the inbox never shows

Researcher Mark B’s disclosure concerns WAP Push, a type of data message handled by the phone’s telephony software. A malformed length value reaches code that cannot process it safely, producing an unhandled exception. Because this happens below the ordinary messaging interface, advice to avoid suspicious links does not address this particular route.

The researcher reports reproducing failures on Pixel and Samsung devices and explains how queued messages and carrier redelivery can prolong the disruption. Those tests establish a serious failure mode; they are not a measurement of the number of people attacked. Nor does a phone temporarily losing service, by itself, identify this vulnerability as the cause.

The distinction between a transient crash and persistent disruption matters. Restarting a component can restore a call service after one failure. If the same bad input remains waiting to be processed, however, restarting can bring the component back to the same failure. That is why simply rebooting is not necessarily a durable remedy.

The fix also deals with the queue

Google’s code change broadens exception handling during decoding and adds handling that removes the problematic message tracker when processing fails. Its tests cover malformed input and recovery to the idle state. The change addresses both the immediate failure and the risk of repeatedly trying the same invalid work.

There are several dates to keep separate. The commit lists a June 15 authoring date and an August 5 commit date for that branch. Neither date proves when a manufacturer shipped the change to a phone. The researcher describes October patches for Android 14–17, while Android Authority’s report records a conflicting November-bulletin account from GrapheneOS.

An Android version number is also an imperfect shortcut. Different manufacturers and branches can receive fixes on different schedules. The practical evidence is the supported device’s update record, rather than a claim that every phone on a broad Android generation is either affected or protected.

Recovery should not start with wiping the phone

The researcher’s site includes a technical recovery discussion involving the pending-message queue. It is not a universal consumer procedure: changing telephony storage incorrectly can remove messages or settings. A recurring crash should be taken to the manufacturer or a qualified support team, with the symptoms and software version recorded. A factory reset is a destructive step, not a substitute for confirming the underlying fix.

For emergency communication, a device that is losing service should not be the only available route; use another working phone when needed. The security lesson is unusually concrete. A phone’s ability to receive a background message is part of its attack surface even when the owner is doing everything right. A useful update must make that message harmless before the user ever has to notice it.