Security researcher Mark B released a proof‑of‑concept attack called “SMS of Death” on 29 October 2026 that can knock an Android phone off the mobile network with a single text message.

The exploit uses a WAP Push SMS, which is processed silently in the background; the message never appears in the inbox and the sender remains hidden.

When the phone receives the specially crafted eight‑byte payload, Android miscalculates memory allocation, storing a negative value that crashes the Phone service responsible for calls, signal and SMS, causing ongoing drops—including emergency calls to 999 or 112.

Phones running Android 12 and 13 are vulnerable and will not receive a fix, whereas devices on Android 14 and later have a patch that deletes the malicious message and prevents recurrence.

The fix was authored by a Google engineer on 15 June 2026 and merged into the security branches for Android 14‑17 in August, but the October security bulletin lists patches only for Android 14 and newer, leaving the exact rollout date unclear.

If a device repeatedly restarts and presents a “wipe data” option, users are advised not to select it; instead, they should seek assistance to clear the stuck messages using ADB, the Android developer tool, to avoid data loss.