SMS of Death: Android Flaw Lets One Text Crash Phone Service

A newly disclosed Android vulnerability, nicknamed SMS of Death, lets an attacker disrupt a phone with a single specially crafted text message. The flaw is tracked as CVE-2026-58882 and was detailed by security researcher Mark Blah. It is a zero-click denial-of-service bug: the user does not need to open or even see the message for the attack to work.

How the attack works

According to the researcher, the problem lies in the WapPushOverSms.decodeWapPdu function. It fails to properly validate a header length value. When a crafted eight-byte WAP Push message is converted into a signed 32-bit integer without range checks, the result is a negative number. That triggers a NegativeArraySizeException and crashes the com.android.phone process, which handles cellular connectivity.

Because Android processes the message before it reaches the inbox, it is hard for a user to tell what caused the failure. A crash also interrupts ongoing calls, including calls to emergency services.

The crashes can repeat. The researcher notes that this may happen when a carrier tries to redeliver the malicious message, or when Android processes messages already stored on the device. Such messages can be removed manually through Android Debug Bridge (ADB), but that is realistic only for technically skilled users.

Who is affected

Google fixed the issue in its October 2026 Android security updates for versions 14 through 17, according to Blah. Devices running the older Android 12 and 13 remain vulnerable.

Blah has also published a proof-of-concept exploit that can send such messages from another Android device, which lowers the barrier for abuse. Users are advised to install the latest security updates. Owners of phones stuck on Android 12 or 13 have no patch to apply, so their exposure continues for now.