DEV Community

Anoymask
Anoymask

Posted on

Android SMS of Death: Zero-Click Telephony DoS via Malformed WAP Push SMS

#security #threatintel

1. Basic Information

2. Executive Summary

Researcher Mark B published a proof-of-concept (PoC) that crashes com.android.phone without user interaction due to a processing flaw that fails to validate WAP Push header lengths. While AOSP includes a fix, CVE-2026-58882 is a designation used by BleepingComputer, and its mapping has not been confirmed in the researcher's commentary or Google's October security bulletin. The scope of impact, remediation bounds, and effects on emergency calls are treated as researcher claims.

Active exploitation has not been confirmed, and the affected versions and CVE associations are unverified by the Google bulletin, though the issue can crash the telephony process using only a phone number without user interaction, potentially causing call drops or crash loops via message retransmission.

3. Attack Flow

Telephony Crash via Malformed WAP Push SMS

  1. An attacker sends a malformed WAP Push data SMS to port 2948 on the target phone number. Reachability conditions depend on carrier and device implementations and remain unconfirmed.
  2. decodeWapPdu() casts a 5-byte uintvar from long to int without range checking, using a negative value for the byte array size.
  3. A NegativeArraySizeException remains unhandled on the telephony main thread, crashing com.android.phone and interrupting active calls and cellular functionality.
  4. Carrier retransmissions or raw database reprocessing of poisoned messages can trigger a crash loop. The AOSP fix catches the RuntimeException and deletes the message.

4. Attacker Positioning and Execution Location

  • A remote attacker sends a WAP Push data SMS to port 2948 via a carrier, using the target's phone number. The researcher states that device accounts or application permissions are not required.

5. Victim and Administrator Perspectives

Victims

  • Messages do not appear in the SMS inbox, and symptoms may manifest as sudden call disconnections, cellular service outages, or reboots/recovery loops.

Administrators

  • Indicators include a NegativeArraySizeException in com.android.phone, WapPushOverSms stack traces, poisoned trackers in the raw SMS database, port 2948 data SMS traffic, and rapid, repeated telephony crashes.

6. Success and Failure Conditions

Success Conditions

  • The carrier successfully delivers the malformed WAP Push data SMS to the target device.
  • The device's WapPushOverSms lacks exception handling for the flaw, and the OEM build is affected.

Failure Conditions and Mitigations

  • Apply security updates provided by OEMs and carriers. Because the issue is absent from the Google bulletin, verify vendor-specific release notes and builds.
  • Migrate unsupported devices, and coordinate with carriers to verify the feasibility of filtering malformed WAP Push traffic on port 2948.
  • In the event of a crash loop, device administrators should preserve evidence and, only if ADB is available, consider deleting the affected pending SMS database rows described by the researcher. Deleting all SMS messages or factory resetting the device are last resorts due to data loss.

7. Impact Upon Success

  • Loss of cellular service and termination of active calls due to com.android.phone crashes.
  • Device unavailability caused by reboot/recovery loops triggered by message retransmissions and reprocessing.
  • While the researcher notes potential impacts on emergency calls, independent verification is lacking.

8. Observable Logs

Inference: The following are candidate logs for internal investigation, dependent on logging configurations and product visibility. This does not imply that all items were recorded in the primary source.

  • Email: Not applicable
  • Proxy / SWG / DNS: Not applicable
  • Endpoint / EDR: Look for Android logcat entries including FATAL EXCEPTION, Process: com.android.phone, NegativeArraySizeException, and the WapPushOverSms.decodeWapPdu stack trace.
  • Identity / IdP: Not applicable
  • SaaS / Cloud: Not applicable
  • Network: Verify data SMS traffic on port 2948 via carrier or MDM telemetry, repeated transmissions from the same sender, and radio service resets.

9. Attack Success Determination

Inference: The following are criteria based on public information or internal assessment, distinguishing contact from success.

  • Attack Attempt Observed (Success Unconfirmed): Criteria: Malformed WAP Push data SMS is identified on the target device or carrier without a corresponding telephony crash. Denial of service must be evaluated separately and is not treated as attacker code execution. Target: Android devices/carriers.

Service disruption is determined by correlating com.android.phone exceptions, reboots, or call disconnections immediately following the receipt of the relevant SMS. This indicates a denial of service, not attacker code execution or device compromise.

10. Investigation Playbook

Inference: Internal investigation procedures.

  • Trigger: Unexplained call disconnections, com.android.phone crashes, reboot loops, or port 2948 data SMS traffic.
  • Initial Checks: Verify device model, Android version, security patch level, carrier, timestamp, active call status, and retransmission counts.
  • Endpoint: Preserve logcat, bugreports, radio/telephony logs, raw SMS databases, and crash dumps. Correlate stack traces with message reception timestamps.
  • Identity and Cloud: Not applicable
  • Follow-On Activity: Check for repeated transmissions from the same sender to the same target, simultaneous occurrences across multiple devices, carrier retransmissions, and recovery loops.
  • Containment: Isolate the device from new SMS reception by enabling Airplane Mode or disconnecting the SIM/network. Note that reprocessing of stored messages may still occur. After preserving evidence, administrators should consider applying patches or deleting the target SMS if ADB is available.
  • Classification: Record message delivery, parser exceptions, telephony restarts, call disconnections, reboot loops, and recovery success separately.

11. Defense and Detection Ideas

  • Single Event: Detect NegativeArraySizeException within WapPushOverSms.decodeWapPdu.
  • Time Series: Correlate port 2948 data SMS delivery with subsequent com.android.phone crashes, service restarts, reprocessing of the same message, and reboots.
  • Threat Hunting: Query MDM or carrier telemetry for concurrent telephony crashes, identical senders, and matching PDU patterns.
  • Logging Gaps: Consumer devices often lack access to raw SMS and telephony logs, and messages may not remain in the inbox, complicating root cause analysis.
  • Priority Controls: Prioritize OEM updates, migration of unpatched devices, carrier coordination, and mobile incident evidence collection procedures.

12. Facts, Inferences, and Hypotheses

Facts

  • Researcher Mark B published a technical analysis and PoC that crashes WapPushOverSms.decodeWapPdu() using an 8-byte malformed WAP Push data SMS sent to port 2948.
  • The 5-byte uintvar 88 80 80 80 00 decodes to 0x80000000 and casts to a signed integer of -2147483648 without range checking. Using this value for a byte array size triggers a NegativeArraySizeException, halting the com.android.phone main thread.
  • The message is processed as a data SMS and does not appear in the standard SMS inbox. No user interaction is required.
  • The researcher reproduced the crash on Android versions 12 through 16. On Android 12, transmitting 20 messages resulted in a recovery reboot loop approximately every 90 seconds, which was initially resolved with a factory reset. While Android 17 is included in the affected range in the text, reproduction steps on the public page only cover up to Android 16.
  • AOSP commit 735d9672603fa206c4b43cb668c1aa273db70b97 catches RuntimeExceptions during decoding and broadcasting, removing poisoned messages from the raw database to prevent persistent crash loops.
  • The researcher states that patches were included in the October 2026 security updates for Android 14 through 17, while Android 12 and 13 remain unpatched as they fall outside the active security update window.
  • CVE-2026-58882 is an identifier reported by BleepingComputer. This ID is not confirmed in the researcher's commentary, the AOSP fix commit, or the Google October 2026 Android Security Bulletin. Active exploitation, carrier-specific reachability, patch propagation across all OEM builds, and real-world impacts on emergency calls remain independently unconfirmed.

Inferences

  • Inference: Because WAP Push data SMS delivery depends on carrier and device implementations as well as filtering rules, the reachability of the PoC should not be generalized to all Android devices without verification via telephony crashes and radio/SMS logs.

Hypotheses

No additional hypotheses. Unverified items are documented under Limitations and Unknowns.

13. MITRE ATT&CK Mapping

This issue involves an SMS-initiated Android denial of service that does not require prior access to the device. Enterprise technique T1499.004 does not list Android as a target platform, while Mobile technique T1642 applies after adversaries gain device access. A precise mapping is therefore omitted.

14. Limitations and Unknowns

  • Active exploitation, carrier/OEM-specific reachability, reproduction on Android 17, real-world impact on emergency calls, patch deployment status across all devices, and the correspondence between news reports of the CVE number and official records remain unconfirmed.

15. Impact on SOCs and Organizations

Organizations running Android 14 through 17 should verify the deployment status of security updates provided by OEMs and carriers. For Android 12 and 13 devices, which the researcher reports as unpatched, plan migration to devices that can receive updates. Telephony crash spikes, port 2948 data SMS activity, and reboot loops must be investigated in coordination with device support and carriers.

16. Summary by Role

  • SOC: Correlate telephony process crashes, port 2948 data SMS traffic, message retransmissions, and reboot loops using device and carrier logs.
  • Administrators: Review OEM bulletins and device patch levels, and include unpatched Android 12 and 13 devices in migration plans.
  • Users: If unexplained call disconnections or reboots recur, avoid factory resetting the device and contact administrators or carriers through alternative communication channels.

Top comments (0)