SMS of Death Flaw Can Remotely Crash Android Phones

By PhishPin Threat Research · 31 Oct 2026 · 2 min read

A newly published proof-of-concept exploit demonstrates how an unpatched vulnerability in Android, labelled "SMS of Death", allows remote adversaries to bring down mobile devices or sever mobile network connectivity simply by delivering a tailored text message. Tracked under the identifier CVE-2026-58882, the zero-click denial-of-service issue requires no action whatsoever from the recipient.

Because the operating system handles incoming communications prior to them reaching the user inbox, victims receive no immediate visual clue explaining why their handset failed. The vulnerability can abruptly terminate active voice communications, including urgent calls placed to emergency services.

Vulnerability details and scope

According to vulnerability researcher Mark Blah, Google resolved the security defect within its October 2026 patch cycle for Android versions 14 to 17. Nevertheless, the issue was omitted from the official October security bulletin, leaving handsets running Android 12 and Android 13 exposed since they did not receive the remedy.

Blah shared a technical breakdown demonstrating that the weakness stems from absent bounds validation on a header-length value inside Android's WapPushOverSms.decodeWapPdu routine.

How the exploit triggers crashes

To leverage the flaw, an adversary delivers an eight-byte malformed WAP Push message to the target device. When the system converts this input into a signed 32-bit integer without proper boundary checks, it yields a negative value of -2147483648.

The operating system then attempts a memory allocation based on this negative figure, provoking a NegativeArraySizeException. This uncaught exception immediately crashes the core com.android.phone system process.

Because this specific component governs mobile networking operations, its sudden failure breaks cellular communication and disconnects ongoing phone conversations, including attempts to reach emergency response dispatchers.

Infinite reboots and recovery methods

Blah observed that the assault can lead to recurring failures if network operators try retransmitting the unreceived data, or whenever Android attempts to read files previously preserved on the device.

During practical assessments, the researcher noted that transmitting twenty malicious payloads could trap devices inside an unending boot sequence. In one trial involving a phone running Android 12, the handset repeatedly restarted into its recovery environment roughly every 90 seconds, forcing the owner to initiate a complete factory wipe to regain access.

Mitigations and vendor response

A contributor on GitHub known as Sakis formulated an alternative technique to erase the offending messages utilising the Android Debug Bridge (ADB). However, this workaround demands access to a desktop computer alongside more sophisticated technical expertise.

The security researcher has also released code demonstrating how an attacker can dispatch the malicious payloads using an everyday Android handset.

Google introduced a resolution designated "Fix remote DoS in decodeWapPdu", which prevents device lockups by trapping the exceptions generated during packet decoding. Furthermore, the update clears out corrupted transmissions from the local SMS database so they cannot cause perpetual disruptions.

While security patches are normally applied automatically across eligible hardware, rollouts depend on specific cellular carriers and device manufacturers, with a system reboot typically needed to finalise deployment. Handset owners are urged to apply pending updates without delay.

By the numbers

Headlines like this one tend to be followed by fake update pages and copycat apps, so we checked what our data shows for "android".

The search turned up 7 phishing hostnames with "android" planted in the address, on 6 different domains.

In addition, 8 newly registered domains carry the same string over the past two weeks.

Frequently asked questions