SecurityNov 4, 2026, 12:53 AM UTC·2 min read

Android 'SMS of Death' Flaw Can Crash Phones With One Text

A zero-click Android bug, CVE-2026-58882, lets attackers cut cellular service or send phones into reboot loops with one crafted text. A working proof of concept is public.

A smartphone with a cracked screen showing a no-signal icon and an incoming text message warning. — Image: عالم التقنية

SUMO

Dialo

ediviewer

Security researcher Mark Blah has disclosed an Android vulnerability dubbed "SMS of Death", tracked as CVE-2026-58882. A single specially crafted text message can disable a phone's cellular connection or knock the device out remotely. The researcher has also published a working proof of concept.

The flaw is a zero-click attack: the victim does not need to open or tap anything. It can cut ongoing calls, including emergency calls. The malicious message is processed before it reaches the inbox, so the victim sees no visible clue about why the phone is failing.

How the bug works

According to the researcher, the code in WapPushOverSms.decodeWapPdu does not validate a header length value. An attacker only needs to send a malformed eight-byte WAP Push message, delivered as a data message to port 2948. The value turns negative, memory allocation fails, and the com.android.phone process, which handles cellular functions, crashes and drops the network connection.

Repeated crashes are possible when carriers retry delivery of the malicious messages, or when Android processes messages already stored on the device. In tests, sending 20 malicious messages put phones into a continuous reboot loop. One Android 12 device rebooted into recovery mode roughly every 90 seconds and only recovered after a factory reset. A GitHub contributor named Sakis found a way to delete the messages with the ADB tool, but it requires advanced technical skill and a computer.

Who is affected

The researcher says Google fixed the issue in the October 2026 security updates for Android 14, 15, 16 and 17, although it was not listed in that month's official bulletin. Devices on Android 12 and 13 remain vulnerable because they did not receive a fix, as does any phone that has not yet received the October 2026 update.

Google's fix catches exceptions raised while handling malformed messages and deletes the malicious messages from the text message database to prevent repeated crashes. Delivery of patches depends on the phone maker and the carrier, so some devices will lag, as has been the case with models such as the Galaxy S24 Ultra, which received the update in stages.

With exploit code now public, Android users should install the latest available security update as soon as possible.