Android 'SMS of Death' Exploit Can Crash Unpatched Phones

A security researcher has published a proof-of-concept exploit for a recently patched Android vulnerability dubbed “SMS of Death” and tracked as CVE-2026-58882. A specially crafted text message can remotely disrupt cellular service or crash a phone without any interaction from its user.

The flaw can interrupt ongoing calls, including emergency calls. Android processes the message before it reaches the SMS inbox, so victims may see no indication of what caused a crash. The researcher, Mark Blah, said Google reportedly patched the issue in its October 2026 security updates for Android 14 through 17. The vulnerability is not listed in Google’s October security bulletin, and Android 12 and 13 devices remain vulnerable because they did not receive the fix.

Blah’s analysis attributes the flaw to improper validation of a header-length value in Android’s WapPushOverSms.decodeWapPdu function. A malformed eight-byte WAP Push message can cause a negative memory-allocation value and crash the com.android.phone process, which manages cellular functions.

The researcher said carriers’ attempts to redeliver malicious messages, or Android’s attempts to process messages already stored on a phone, can trigger repeated crashes. In testing, 20 malicious messages could leave phones stuck in reboot loops. One Android 12 device rebooted into recovery mode about every 90 seconds. A GitHub contributor identified a way to remove the messages using Android Debug Bridge (ADB), but it requires a computer and more technical knowledge.

Google’s fix catches exceptions and deletes malicious messages from the SMS database. Android updates generally install automatically on supported devices, but timing depends on the manufacturer and carrier, and a restart may be needed. The source reports that the proof of concept can send the messages from another Android device.