A security vulnerability has been found that can cripple calling functions on Android smartphones simply by sending a specially crafted text message (SMS). The attack works as a zero-click method, meaning it can occur even if the user does not open the message or tap a link. Caution is required as it could also affect emergency calls.

On Oct. 30 (local time), Japanese media outlet GIGAZINE reported that security researcher Marc Blanchut (마크 블라슈치크) identified a vulnerability in Android’s communications handling function that is referred to as “SMS of Death.”

The issue occurs during the processing of WAP Push messages, which carriers and others use to transmit special data. Android automatically parses the messages, but insufficient validation when converting the data length into a number can cause abnormal memory allocation errors.

The error forces the system process responsible for calling functions, “com.android.phone,” to shut down. As a result, voice calls and mobile communications are temporarily suspended, and ongoing calls can be disconnected.

In particular, the attack message does not appear in standard messaging apps, and the sender number cannot be checked, making it difficult for users to notice an attack.

In tests by the research team, a single crafted SMS disrupted calling functions for about 1 to 2 seconds. In one confirmed case, intermittent communications disruptions lasted up to a week because carriers tend to repeatedly resend unprocessed messages.

Sending about 20 messages in a row also caused situations where a smartphone did not operate normally for an extended period. If malicious messages remain pending for receipt, the error can repeat even after rebooting.

The researcher reproduced the vulnerability on several Android models, including the Google Pixel 9. The researcher pointed out that the risk is significant because not only regular calls but also emergency calls can be disrupted.

The vulnerability was reported to Google on May 5. A fix to improve error handling was later registered in the Android source code dated June 15 and was reflected in the October security update.

The patched system prevents the calling process from terminating even if an error occurs while handling an abnormal message, and deletes the record of the message that caused the problem.

The related fix is provided in Android versions 14 to 17, but the rollout timing may differ depending on manufacturer and model. Users are advised to check in smartphone settings whether the security update has been applied.