A critical zero-click remote denial-of-service vulnerability affects Android telephony. A malformed WAP Push SMS containing a 5-byte uintvar decodes to a negative array size, causing com.android.phone to crash. The attack requires no victim interaction; the message is delivered silently as a data SMS, leaving no inbox trace.
Upon receipt, the main telephony thread throws a Negative Array Size Exception, terminating active voice calls including emergency calls. The process restarts after 1-2 seconds of service loss. Rapid payload delivery exploits a SQLite race condition, corrupting the message database.
Once corrupted, the device crashes on every boot. A factory reset fails as carriers re-send the payload, re-triggering the crash. Full recovery requires removing the SIM and inserting it into a non-Android device.
Tested across Pixel 9 and various Samsung models with 100% reproduction rate. Vendor status is Won't Fix. The researcher, Mark Blaszczyk, reported the issue on May 5, 2026, with disclosure on October 29, 2026, after a 90-day timeline.
No CVE was issued.
Source: Hacker News · Summarized by HeadlinesBriefing