A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability that can remotely crash phones and interrupt ongoing calls, including emergency calls, by sending a specially crafted text message. In testing, sending 20 malicious messages could cause phones to enter reboot loops. Google reportedly patched the flaw in its October 2026 security updates for Android 14 through 17, but older Android 12 and 13 devices remain vulnerable.
The vulnerability, tracked as CVE-2026-58882 and dubbed "SMS of Death," is a zero-click denial-of-service flaw that does not require any interaction from the target. Researcher Mark Blah published a technical analysis and a working exploit that sends a malformed eight-byte WAP Push message as a data SMS to port 2948. The message causes a negative value to be passed to Android's memory allocation function, triggering a crash of the com.android.phone process that manages cellular functions. This disconnects ongoing calls, including calls to emergency services, and can interrupt mobile connectivity.
According to Blah, Google reportedly patched the flaw in its October 2026 security updates for Android 14, 15, 16 and 17. However, the vulnerability is not listed in Google's security bulletin for that month, and devices running Android 12 and 13 did not receive the patch. Blah said the flaw can cause repeated crashes if carriers attempt to redeliver the malicious message or if Android tries to process messages already stored on the phone. In testing, sending 20 malicious messages could cause phones to enter reboot loops; one Android 12 device rebooted into recovery mode approximately every 90 seconds, requiring a factory reset to recover.
A GitHub contributor named Sakis discovered a method to remove the malicious messages using Android Debug Bridge (ADB), but this requires a computer and advanced technical knowledge. Android security updates are typically installed automatically on supported devices, but their availability depends on the manufacturer and carrier. With the exploit now publicly available, users are advised to install the latest updates to protect their devices.
Analysis
Why This Matters
- The exploit requires no user interaction, making it a credible threat to anyone whose device is vulnerable.
- It can disrupt emergency calls, posing a direct risk to personal safety.
- Older Android devices (12 and 13) are left exposed, and the vulnerability's absence from Google's security bulletin may mean many users are unaware of the patch.
Background
Android releases monthly security patches that Google sends to manufacturers, who then customise and distribute updates to devices. The timeline for older devices to receive patches varies and often ends after a few years. CVE-2026-58882 is a denial-of-service flaw in the WAP Push message handler that was fixed in the October 2026 update for Android 14 through 17.
What to Watch
- Reports of active exploitation in the wild, particularly against devices running Android 12 or 13.
- Whether Google updates its October security bulletin to include CVE-2026-58882.
- Steps taken by carriers and manufacturers to push the fix to older devices or provide alternative mitigations.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedA researcher published a proof-of-concept exploit for the “SMS of Death” vulnerability that can target unpatched Android phones.BleepingComputer: “A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882”
- SupportedA specially crafted text message can remotely crash phones and disrupt ongoing calls, including emergency calls.BleepingComputer: “The zero-click denial-of-service flaw can interrupt ongoing calls, including emergency calls, without requiring any interaction from the target.”
- SupportedThe attack requires no interaction from the target.BleepingComputer: “The zero-click denial-of-service flaw can interrupt ongoing calls, including emergency calls, without requiring any interaction from the target.”
- SupportedSending 20 malicious messages could cause phones to enter reboot loops.BleepingComputer: “When testing the flaw, the researcher found that sending 20 malicious messages could cause phones to get stuck in reboot loops.”
- SupportedGoogle reportedly patched the flaw in its October 2026 security updates for Android 14 through 17.BleepingComputer: “According to the vulnerability researcher, Mark Blah, Google reportedly patched the vulnerability in its October 2026 Android security updates for Android 14 through 17.”
- SupportedAndroid 12 and 13 devices remain vulnerable because they did not receive the fix.BleepingComputer: “However, the flaw is not listed in Google's October security bulletin, and older Android 12 and 13 devices remain vulnerable because they did not receive the fix.”
- SupportedThe vulnerability is CVE-2026-58882 and is dubbed “SMS of Death.”BleepingComputer: “A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882”
- SupportedThe exploit uses a malformed eight-byte WAP Push message sent as a data SMS to port 2948.BleepingComputer: “To exploit the flaw, an attacker can send the following malformed eight-byte WAP Push message to targeted phones: 01 06 88 80 80 80 00 BE → sent as a data SMS to port 2948”
- SupportedA negative value passed to Android's memory allocation triggers a crash of the com.android.phone process.BleepingComputer: “When Android attempts to allocate memory using this negative value, it triggers a NegativeArraySizeException that crashes the com.android.phone process.”
- SupportedThe flaw can cause repeated crashes if carriers redeliver malicious messages or Android processes messages already stored on the phone.BleepingComputer: “The researcher says the attack can also cause repeated crashes when carriers attempt to redeliver malicious messages or Android tries to process messages already stored on the phone.”
- SupportedOne Android 12 device rebooted into recovery mode approximately every 90 seconds and required a factory reset to recover.BleepingComputer: “On one Android 12 device, the phone rebooted into recovery mode approximately every 90 seconds, requiring the user to perform a factory reset to recover.”
- SupportedA GitHub contributor named Sakis found a way to remove the malicious messages using ADB, but it requires a computer and advanced technical knowledge.BleepingComputer: “A GitHub contributor named Sakis discovered a way to remove the malicious messages using Android Debug Bridge (ADB), but the process requires more advanced technical knowledge and access to a computer.”
