Yaqinda aniqlangan Android zaifligi, SMS of Death deb ataladigan, hujumchilarga faqat bitta noto'g'ri formatlangan SMS orqali telefonning telekommunikatsiya jarayonini isdan chiqarish imkonini beradi, jabrlanuvchidan hech qanday o'zaro ta'sir talab qilinmaydi.
Tadqiqotchi Mark B bu kamchilik faol qo'ng'iroqlarni, shu jumladan favqulodda qo'ng'iroqlarni uzishi mumkinligini va zararli xabarlar navbatda qolganida doimiy xizmat uzilishlariga olib kelishini xabar qiladi.
Tadqiqotchi bu muammoni 2026-yil 5-mayda Google'ning Android va Qurilmalar Zaiflik Mukofot Dasturi orqali xabar qilgan va texnik ochiqlashni 29-oktabrda e'lon qilgan. Hisobotga ko'ra, tuzatishlar Android 14 dan 17 gacha bo'lgan versiyalar uchun Android'ning 2026-yil oktyabr xavfsizlik yangilanishida taqdim etilgan.
Zaiflik Android telekommunikatsiya tizimidagi WapPushOverSms.decodeWapPdu() funksiyasida joylashgan. Kiruvchi WAP Push ma'lumot xabarlari bu tahlilchiga SMS porti 2948 orqali yetib boradi. Oddiy matnli xabarlardan farqli o'laroq, zararli yuklama xabarlar qutisida ko'rinmaydi va yuboruvchining raqamini qabul qiluvchiga ko'rsatmaydi.
Qayta ishlash jarayonida Android Wireless Session Protocol sarlavhasi uzunligini o'zgaruvchan uzunlikdagi imzosiz butun son sifatida o'qiydi. Dekoder long qaytaradi, lekin amalga oshirish uni to'g'ridan-to'g'ri imzolangan 32-bitli int ga aylantiradi, uning diapazonini tekshirmasdan.
O'ta katta qiymat aylantirishdan so'ng salbiy bo'ladi. Keyin Android bu salbiy qiymatni bayt massivini ajratish uchun ishlatadi, bu esa asosiy telekommunikatsiya oqimida ushlanmagan NegativeArraySizeException ni keltirib chiqaradi va com.android.phone ni tugatadi.
Bu muammo zero-click Android hujum yuzalariga oid xavotirlarni kuchaytiradi, garchi bu ochiqlash kod bajarilishi yoki ma'lumot o'g'irlanishi emas, balki xizmatni rad etish (denial of service) haqida gapiradi.
Tadqiqotchi har bir ishdan chiqish uchun bir-ikki soniya telekommunikatsiya xizmati yo'qotilishini kuzatgan. Operator qayta yetkazib berishi buzilishni kuchaytirishi mumkin, chunki tasdiqlanmagan xabarlar qayta kelishi mumkin va jarayonni takroran tugatishi mumkin.
Sinovlar muammoni 2026-yil aprel proshivkasi bilan ishlaydigan Pixel 9 va bir nechta Samsung Galaxy qurilmalarida takrorlagan. Sinovda bitta xabar bir haftagacha davom etgan vaqti-vaqti bilan uzilishlarga sabab bo'lgan; taxminan 20 ta xabar qurilmaning uzoq muddat foydalanilmasligiga olib kelgan. Bu natijalar tadqiqotchining sinovlarini aks ettiradi, Android qurilmalari bo'yicha universal natijalar emas.
Android'ning kiruvchi SMS navbatidagi doimiy xabarlar qayta yuklashdan keyin ham ishdan chiqishlarga sabab bo'lishi mumkin. Bir hissa Android 12 holatini hujjatlashtirgan, bunda qayta tiklash rejimida takroriy qayta yuklashlar kuzatilgan. Android Debug Bridge orqali maqsadli navbatni tozalash operatsiyani zavod sozlamalariga qaytarmasdan tiklagan, lekin texnik kirish talab qilgan.
Ochiqlashga ko'ra, Google istisno ishlov berishni kengaytirib, ish vaqtidagi xatolarni ushlash va trigger xabarlarini tozalashni qo'shgan, bu esa takroriy qayta ishlashni oldini oladi. Bu tadqiqotchining taklif qilgan sarlavha uzunligi diapazon tekshiruvidan farq qiladi.
Foydalanuvchilar o'z ishlab chiqaruvchisining 2026-yil oktyabr xavfsizlik yangilanishini yoki tuzatishni o'z ichiga olgan keyingi versiyani o'rnatishlari kerak. Boshqa Android xavfsizlik yangilanishlari singari, yamoq mavjudligi ochiqlash bilan bir xil darajada muhim. E'lon qilingan proof of concept ni faqat aniq ruxsat etilgan sinovlar uchun cheklang, chunki buzilish favqulodda aloqalarga ta'sir qilishi mumkin.
SOC'ingizga hodisalarni tez to'xtatish uchun ogohlantirish kontekstini bering. 16K SOC'dan tahdid razvedkasini integratsiya qiling.
A recently discovered Android vulnerability, referred to as SMS of Death, allows attackers to crash a phone’s telephony process with just one malformed SMS, without any interaction from the victim.
Researcher Mark B reports that this flaw can disconnect active calls, including emergency calls, and leads to persistent service disruptions when malicious messages remain in the queue.
The researcher reported the issue through Google’s Android and Devices Vulnerability Reward Program on May 5, 2026, and published the technical disclosure on October 29. According to the report, fixes shipped in Android’s October 2026 security update for Android 14 through 17.
The vulnerability resides in WapPushOverSms.decodeWapPdu(), within Android’s telephony framework. Incoming WAP Push data messages reach this parser through SMS port 2948. Unlike ordinary text messages, the malicious payload does not appear in the messaging inbox or expose the sender’s number to the recipient.
During processing, Android reads the Wireless Session Protocol header length as a variable-length unsigned integer. The decoder returns a long, but the implementation casts it directly to a signed 32-bit int without validating its range.
An oversized value becomes negative after conversion. Android subsequently uses that negative value to allocate a byte array, triggering an uncaught NegativeArraySizeException on the main telephony thread and terminating com.android.phone.
The issue adds to concerns surrounding zero-click Android attack surfaces, although this disclosure describes denial of service rather than demonstrated code execution or data theft.
The researcher observed one to two seconds of lost telephony service per crash. Carrier redelivery can amplify the disruption because unacknowledged messages may arrive again, repeatedly terminating the process.
Testing reportedly reproduced the issue on a Pixel 9 running April 2026 firmware and several Samsung Galaxy devices. In testing, a single message caused intermittent outages lasting up to a week; about 20 messages produced extended device unusability. These findings reflect the researcher’s tests, not universal results across Android handsets.
Persistent messages in Android’s pending inbound SMS queue can also trigger crashes after reboot. A contributor documented an Android 12 case involving repeated recovery-mode reboots. Targeted queue cleanup through Android Debug Bridge restored operation without a factory reset, but required technical access.
According to the disclosure, Google broadened exception handling to catch runtime failures and added cleanup of triggering messages, preventing repeated processing. This differs from the researcher’s proposed header-length bounds check.
Users should install their manufacturer’s October 2026 security update or a later release containing the fix. As with other Android security updates, patch availability matters as much as disclosure. Restrict the published proof of concept to explicitly authorized testing because disruption can affect emergency communications.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.