Proof-of-concept published October 31, 2026; Google fix in October 2026 updates for Android 14 to 17
SMS of Death: A Public Exploit Crashes Android Phones With One Invisible Text, and Android 12 and 13 Have No Fix
A security researcher, Mark Blah, has released a proof-of-concept exploit for CVE-2026-58882, dubbed SMS of Death, a zero-click denial-of-service flaw in how Android handles WAP Push messages. The malformed message is only eight bytes, sent as a data SMS to port 2948, and the victim never sees it: Android processes it before it reaches the SMS inbox. The flaw is improper validation of a header-length value in the WapPushOverSms.decodeWapPdu function: a value that converts to a negative signed 32-bit integer makes Android attempt a memory allocation of that size, triggering an exception that crashes com.android.phone, the process that manages cellular connectivity. A single message drops ongoing calls, including calls to emergency services, while the process restarts. In the researcher testing, sending about 20 malicious messages could leave a phone stuck in reboot loops, and one Android 12 test device rebooted into recovery mode roughly every 90 seconds until it was factory reset. According to the researcher, Google patched the flaw in its October 2026 Android security updates for Android 14 through 17, although the flaw is not listed in the October security bulletin, and Android 12 and 13 devices did not receive the fix and remain vulnerable. Google fix catches the exception when processing malformed messages and deletes malicious messages from the SMS database so they cannot trigger repeated crashes. A contributor has documented a removal method using Android Debug Bridge for already affected devices, which requires a computer and technical knowledge. No theft of data or takeover of the phone is claimed: the demonstrated impact is loss of availability.
Executives
Availability attacks on personal devices become organizational problems when the device is the second factor, the on-call phone, or the only way to reach a staff member in an emergency. The uncomfortable fact in this disclosure is the support cliff: Android 14 to 17 received the fix in October, Android 12 and 13 did not, so the age of a handset now decides whether a single text can take it offline repeatedly. That is a device lifecycle question, and it belongs in the same review as laptop refresh cycles.
CIO / CISO
Inventory the Android estate by version, not by model: flag every Android 12 and 13 device with access to corporate mail, VPN or authenticator apps as unpatchable for this flaw and plan replacement or restriction. Confirm Android 14 to 17 devices are on the October 2026 security update or later, remembering that carrier and manufacturer timing varies and a restart may be needed to complete installation. Brief support staff on the symptom pattern, repeated phone process crashes or reboot loops after no visible message, so the first report is recognized rather than treated as a hardware failure.
Engineers
If a device is already looping, the documented recovery path is removal of the stored malicious messages with Android Debug Bridge, with factory reset as the fallback the researcher testing required on one device. On patched builds, verify the fix behavior: the update catches the processing exception and purges the malicious messages from the SMS database. Record affected device identifiers and carrier redelivery behavior in the incident notes, because carrier redelivery attempts can re-trigger crashes on unpatched builds.
Everyone (non-IT)
Check your Android version and install the latest security update if your phone runs Android 14 or newer. If your phone runs Android 12 or 13, it cannot be fixed for this flaw, so talk to your carrier or employer about a replacement, especially if the phone is your main line. The attack cannot steal your data or read your messages; it crashes the phone service, which is serious enough on its own if it interrupts an emergency call.