Attackers exploit an unchecked integer cast in Android telephony code by delivering malformed WAP Push SMS messages that leave no trace in the inbox. While an isolated payload terminates running calls, firing roughly 30 payloads in rapid succession corrupts the internal SQLite messaging database to trigger continuous boot crashes. The exploit demonstrated a 100 percent reproduction rate across multiple handsets, including a Pixel 9 running April 2026 firmware alongside various Samsung Galaxy models. Furthermore, network re-delivery of the unacknowledged payloads renders factory resets ineffective, particularly complicating remediation for eSIM users.
Key points
Attackers can exploit zero-click messages to permanently sever emergency service access w…: Attackers can exploit zero-click messages to permanently sever emergency service access without leaving traces in the message inbox.
Carriers automatically re-delivering unacknowledged messages make factory resets largely…: Carriers automatically re-delivering unacknowledged messages make factory resets largely ineffective for restoring affected handsets.
Failure to reach emergency numbers can force network operators like Telstra to permanentl…: Failure to reach emergency numbers can force network operators like Telstra to permanently bar affected devices under telecommunications regulations.
Sources checked by our analysis pipeline: 1
Android Telephony · Zero-Click · Remote DoS
A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim.
⚠ Working proof-of-concept, authorised testing only. Read the warning & license before downloading.
When Android receives a WAP Push message, WapPushOverSms.decodeWapPdu()
reads the WSP header length as a uintvar
. The value comes back as a long
, is cast to int
with no range check, and is then used directly as the size of a new byte array:
// WapPushOverSms.java:217 header length read as long, cast with no bounds check
int headerLength = (int) pduDecoder.getValue32();
...
// WapPushOverSms.java:244 the cast value is used as an array size
byte[] header = new byte[headerLength];
A 5-byte uintvar of 88 80 80 80 00
decodes to 0x80000000
. Cast to a signed 32-bit int
, that is -2147483648
. Allocating new byte[-2147483648]
throws an uncaught NegativeArraySizeException
on the telephony main thread, killing com.android.phone
:
E AndroidRuntime: FATAL EXCEPTION: main
E AndroidRuntime: Process: com.android.phone
E AndroidRuntime: java.lang.NegativeArraySizeException: -2147483648
E AndroidRuntime: at ...WapPushOverSms.decodeWapPdu(WapPushOverSms.java:244)
The tech giant's unveiling of a touchscreen MacBook Pro with an OLED display reverses longstanding executive resistance to hybrid computing designs. Under the leadership of chief executive Ternus, the move aims to modernize the Mac lineup alongside other recent experimental hardware debuts. However, the system faces scrutiny over whether users will embrace touch displays over traditional computational improvements.
Activists have published work records of federal personnel in a searchable database named Icepick to challenge the anonymity of enforcement agents during a broader immigration crackdown. The compromise exposed names, job titles, and contact information across multiple agencies, heavily impacting border protection and immigration enforcement divisions. Federal authorities have launched an active response to evaluate the threat posed to their workforce.
The Telecom Regulatory Authority of India has recommended classifying linear channels delivered over IP networks as telecommunication services under the Telecom Act. This move aims to subject application-based television platforms to an authorisation regime similar to traditional broadcast distributors. However, legal experts and digital media executives fear the precedent could gradually expand telecom oversight to encompass broader over-the-top content applications.