CVE-2026-58882 lets an attacker “remotely disrupt cellular service or crash phones by sending a specially crafted text message,” according to the researcher who published a proof-of-concept for what’s already being called an "SMS of Death." The vulnerability can interrupt ongoing calls — including emergency calls — without any interaction from the target.
CVE-2026-58882: what the bug does
Researcher Mark Blah published a technical analysis and a proof-of-concept for a zero-click denial-of-service flaw in Android’s WapPushOverSms decoding routine, tracked as CVE-2026-58882. The crash occurs before the message reaches the SMS inbox, so victims receive no visible indication of what caused the disruption. When the crash happens it targets the com.android.phone process, which manages cellular functions — producing dropped calls and a loss of mobile connectivity, including disconnected emergency calls.
How the exploit works: the malformed WAP Push message
The flaw stems from improper validation of a header-length value in Android's WapPushOverSms.decodeWapPdu function. Blah published the exact malformed eight-byte WAP Push message that can be sent as a data SMS to port 2948:
01 06 88 80 80 80 00 BE → sent as a data SMS to port 2948
When that sequence is translated into a signed 32-bit integer without a bounds check, it becomes -2147483648. Android then attempts to allocate memory using this negative value, which triggers a NegativeArraySizeException and crashes com.android.phone. The researcher also reports the attack can trigger repeated crashes when carriers redeliver malicious messages or when Android attempts to process messages already stored on the device.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageWhich Android builds received the fix — and which did not
According to Blah, Google reportedly patched the vulnerability in its October 2026 Android security updates for Android 14 through 17. The patch is titled "Fix remote DoS in decodeWapPdu" and both prevents the crashes by catching exceptions triggered when processing malformed messages and removes malicious messages from the SMS database to stop repeated re-triggering.
However, the researcher notes the flaw is not listed in Google's October security bulletin, and older Android 12 and 13 devices did not receive the fix and therefore remain vulnerable.
Recovery options and practical effects observed in testing
In testing, Blah found that multiple messages could make affected phones unstable: sending 20 malicious messages could put phones into reboot loops. On one Android 12 device, the phone reportedly rebooted into recovery mode approximately every 90 seconds and required a factory reset to recover. A GitHub contributor named Sakis found a way to remove the malicious messages using Android Debug Bridge (ADB), but that process requires more advanced technical knowledge and access to a computer. Blah also published a proof-of-concept exploit that can send the malicious messages from another Android device.
Android security updates are generally installed automatically on supported devices, but availability depends on the device manufacturer and carrier, and a restart may be required to complete installation — factors that can leave devices exposed even after a patch is released.
What this means for end users, device makers, and security teams
- End users and the general public: With a working proof-of-concept in circulation, Android users are strongly advised to install the latest security updates to protect their devices. Users of Android 12 and 13 are flagged specifically by the researcher as lacking the reported fix.
- Device manufacturers and carriers: Because update delivery depends on manufacturers and carriers, the practical protection a given phone receives will vary; restart requirements and staged rollouts can delay the moment a device actually becomes safe in practice.
- Technologists and security teams: The exploit underscores that malformed protocol headers can have outsized effects when not validated. The published POC and the availability of an ADB removal method mean defenders need to plan for incident response steps that include message removal and, in worst cases, device recovery procedures such as factory reset.
Two closing notes from the record are worth repeating exactly: "Now that a working proof-of-concept exploit has been released, Android users are strongly advised to install the latest security updates to protect their devices." And, more broadly, "Overall prevention scores can hide what happens after initial access." The Blue Report 2026 is cited as measuring defenses across simulations, but the immediate, concrete step remains: ensure your device has received and applied the October 2026 update where it is available, and be aware that older devices may not be covered.
Original reporting: https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/
