Android 'SMS of Death' Crash Fix Exists, but Patch Coverage Is Unclear

Google’s Android source tree contains a fix for a remote crash in its telephony code. A researcher calls the issue “SMS of Death” and says a malformed text message can interrupt cellular service without the recipient opening it. The public October Android security bulletin does not identify this issue, leaving the update status of individual devices unclear.

The Google source commit is titled “Fix remote DoS in decodeWapPdu.” Its description says the change catches errors during message decoding and removes a failed message from the raw database to prevent repeated crashes. That is direct evidence of a fix in Android source. It does not establish when each device maker shipped that code to users.

In his disclosure, researcher Mark Blaszczyk reports that the crash can drop active calls, including emergency calls, and that repeated processing can cause a longer disruption. Those impact and device-testing claims are the researcher’s findings; 0dayNews has not reproduced them. The researcher says the fix reached Android 14 through 17 in October and that Android 12 and 13 remain exposed. Google has not confirmed those version-specific rollout claims in its October security bulletin.

What is verified

• Google published source code describing a fix for remote denial of service in Android telephony.
• The October public bulletin does not name this issue or tie it to a security patch level.
• A public proof of concept exists. This report does not include its message bytes, delivery details, or instructions.

No public CVE record for this issue could be confirmed through NVD or the CVE Program at publication. We are therefore omitting the identifier used in some reports. We also cannot assign a severity score or claim exploitation in the wild.

For device owners, install the latest available Android system update from the device manufacturer and check that the installation has completed. A displayed October patch level alone is not proof that this particular fix is present, because the public bulletin does not map the issue to that level. Organizations that need a definitive answer for a device fleet should ask the manufacturer whether its build includes Google’s telephony fix.