Key Takeaways (TL;DR): A new zero-click attack dubbed "SMS of Death" can crash and factory-reset Android smartphones from versions 12 through 17. The exploit code is already public, and the only reliable protection is to disable RCS and block SMS from unknown senders. For a private anti-DPI multi-key that bypasses whitelists, check out @yavpn_robot.

Security researchers have published details of a critical vulnerability in Android's messaging stack, dubbed "SMS of Death." The attack requires no user interaction — just receiving a specially crafted SMS or RCS message is enough to crash the system, and in some cases, trigger a full factory reset. The exploit code has been released publicly, making it a ticking time bomb for millions of devices running Android 12 through 17.

How the "SMS of Death" works

The vulnerability resides in the way Android's default messaging app processes incoming messages. By sending a malformed SMS or RCS packet, an attacker can trigger a buffer overflow in the system's message parser. This overflow corrupts memory in the kernel space, leading to a kernel panic — a complete system crash. On some devices, the corruption is severe enough to wipe the user data partition, effectively performing a factory reset without any confirmation.

The attack is zero-click: the victim doesn't need to open the message, tap a link, or download anything. Simply receiving the SMS is enough. This makes it particularly dangerous for users who keep their devices online and receive messages from unknown numbers.

Who is affected

All Android versions from 12 (released in 2021) through the latest 17 (Android 15-based) are vulnerable. Google has not yet released a patch, and the exploit code is now circulating on hacker forums and GitHub repositories. Devices from Samsung, Xiaomi, OnePlus, and other major manufacturers are all at risk, as the flaw is in the core Android framework, not in vendor-specific skins.

What you can do right now

  • Disable RCS: Go to your messaging app settings and turn off RCS (Rich Communication Services). This prevents the most dangerous attack vectors.
  • Block SMS from unknown senders: Enable the option to filter messages from numbers not in your contacts. This reduces the chance of receiving a malicious SMS.
  • Use a third-party messaging app: Apps like Signal or Telegram don't use the vulnerable Android message parser.
  • Keep your device updated: Monitor for security patches from Google and your device manufacturer.

Long-term protection

Until Google releases a permanent fix, the safest approach is to minimize your attack surface. If your ISP throttles traffic or you need a multi-key that bypasses whitelists for just 5 RUB/day, consider using @yavpn_robot for private, encrypted communication that doesn't rely on SMS.