Android SMS of Death Exploit: Remotely Crashing Unpatched Phones

A security researcher has published a proof-of-concept exploit for a recently patched Android vulnerability, known as SMS of Death and tracked as CVE-2026-58882. This flaw allows attackers to remotely disrupt cellular service or crash target smartphones by sending a specially crafted text message.

• The zero-click denial-of-service flaw disrupts ongoing and emergency calls without user interaction.
• The vulnerability stems from improper header-length validation in WapPushOverSms.decodeWapPdu.
• Google patched it in October 2026 for Android 14 through 17, leaving Android 12 and 13 exposed.
• Sending multiple malicious messages can trap phones in continuous reboot loops requiring factory resets.

Technical Breakdown of the Android Flaw

The vulnerability is triggered by sending a malformed eight-byte WAP Push message to targeted devices. When Android translates this value into a signed 32-bit integer without proper bounds checking, it turns into a negative number. When the system attempts to allocate memory using this negative size, it throws a NegativeArraySizeException that crashes the com.android.phone process.

Because the com.android.phone process controls cellular connectivity, its crash terminates all mobile network functions and disconnects active phone calls, including emergency services. Testing revealed that sending 20 malicious messages could cause devices to get stuck in severe reboot loops, requiring advanced recovery methods.

Patch Status and Manufacturer Rollout

According to the researcher, Google addressed the flaw in the October 2026 Android security updates for Android versions 14 through 17. The patch, titled Fix remote DoS in decodeWapPdu, successfully catches the processing exceptions and purges the malicious messages from the SMS database.

However, the vulnerability was notably absent from Google's official October security bulletin. Furthermore, older Android 12 and 13 devices remain completely unpatched and vulnerable because they did not receive the official fix from device manufacturers or carriers.

What This Means for Android Users

With a working proof-of-concept exploit now publicly available, attackers can more easily target vulnerable devices. Android users are strongly advised to check for and install the latest system security updates as soon as possible to protect their hardware.

If a device becomes trapped in a reboot loop due to the attack, advanced users can remove the malicious text using Android Debug Bridge (ADB) via a computer. Otherwise, recovering the phone may require performing a disruptive factory reset.