The SMS of death exposes Android's real flaw: slow patches

Is a bug really the scandal when the fix has existed for weeks and still hasn't reached many pockets? The "SMS of Death" is a nasty piece of work, but the more uncomfortable story is how long Android users wait for the cure.

An invisible text can take your phone offline

Security researcher Mark Blaszczyk published details of a flaw, along with a proof of concept, that lets a specially crafted WAP Push message crash the part of Android that handles cellular service. According to Heise via Chip, the message is invisible: it never reaches the inbox. An affected phone can restart roughly every 90 seconds and offer a data wipe in recovery mode.

Blogspan reports that the researcher told Google on May 5 and that the fix covers Android 14 to 17 from the October update. Android 12 and 13 reportedly get nothing. Emergency calls can drop too. That last detail is what turns a nuisance into a safety problem.

The bug is ordinary; the delivery chain is the flaw

The technical cause is almost mundane: a length field converted without validation turns negative, and the code doesn't catch the resulting error. Every large codebase has bugs like this, we'd wager. What matters is the time between "fixed" and "installed."

As the German coverage notes, unless you own a Pixel, it can take weeks or even months for your manufacturer to push Google's patches. That is the structural weakness. Google can write the fix, but it can't press the button on your Galaxy, Xiaomi or whatever else sits in your pocket. Meanwhile the exploit code is public. In our view, that combination is what deserves the alarm: a published recipe, a patched upstream, and a long tail of phones left standing in between.

It also helps to keep the threat in proportion. This is a remote crash, not data theft, and nothing we have read suggests mass exploitation. But a phone that loses calls, emergency access and possibly your data (if you panic and tap "Wipe data") is hardly harmless. Disruption is a weapon too, and it looks cheap to aim.

Old phones are the quiet losers

The most damning line is about Android 12 and 13. Those devices will probably stay vulnerable unless manufacturers write their own patches. Blogspan points to a blunt consequence for work phones running those versions: it is a reason to replace them. We'd go further. If a text message can disable a phone and the maker won't fix it, that device has stopped being a reliable phone.

There is also a verification problem. Blogspan notes that the CVE number cited by BleepingComputer didn't show up in the MITRE or NVD records it checked as of November 1, and that Google's October bulletin doesn't name the flaw. The "October 2026 or newer" guidance comes from the researcher alone. That doesn't make it wrong, but it means users are taking a lot on trust, which is a transparency failure of its own.

Check your patch date today, then check your maker's habits

Check your security patch date: Settings, About phone, Android version (menus vary by brand). If it says October 2026 or later, you are protected according to the researcher. If not, install any pending update and restart. Don't wait for the automatic notification.

If your phone is already looping, don't tap "Wipe data." The researcher describes a recovery route via a computer and Android Debug Bridge, but that is a stopgap for the technically comfortable, not a substitute for the update.

Our verdict: stop treating update speed as a footnote in spec sheets. When you buy your next Android, ask how fast the maker ships Google's patches and for how many years. Until manufacturers are held to that standard, the next "SMS of death" will probably find the same long queue of unpatched phones.