Researcher publishes Android SMS of Death exploit crashing unpatched phones

On Oct. 29, 2026, a researcher published a public proof-of-concept exploit for CVE-2026-58882, an Android vulnerability nicknamed SMS of Death. The bug allows a crafted text message to crash a phone or knock it off the cellular network without any interaction from the user. The system handles the message before it ever appears in the SMS inbox, so the recipient never sees a notification or a sender number.

A malicious text can break up active calls, including emergency calls, and sever the phone’s connection to the mobile network. The com.android.phone process runs cellular functions on the device, so when it goes down, mobile connectivity is disrupted and calls are dropped. Cyber Security News reported that active calls end with the reason CS_DEATH when the process restarts.

The researcher’s analysis traced the vulnerability to a missing bounds check on a header-length field inside the WapPushOverSms.decodeWapPdu routine in Android. Converting the header-length field to a signed 32-bit integer without a bounds check produces negative 2147483648, and the system then attempts to reserve memory with that negative value. That allocation attempt triggers a NegativeArraySizeException, which crashes com.android.phone. The byte sequence 88 80 80 80 00 in the message header converts to that negative value.

The exploit sends an eight-byte WAP Push packet over a data SMS on port 2948. WAP Push messages are data texts that bypass the SMS inbox entirely, so they never show up on the recipient’s phone. The published exploit can send these harmful messages from a second Android handset.

Google shipped the fix in its October 2026 security updates, spanning Android 14 through Android 17. The patch, titled Fix remote DoS in decodeWapPdu, catches exceptions in WAP Push processing and strips the harmful messages out of the SMS database. Devices running Android 12 and Android 13 remain unprotected, since Google supplied no patch for those two versions. Testing by the researcher confirmed the vulnerability is present in Android 12 through Android 16, while the October updates cover Android 14, 15, 16 and 17.

Tests on a Pixel 9 with April 2026 firmware and multiple Samsung Galaxy and A-series phones reproduced the crash every time. The researcher observed that roughly 20 malicious messages can put phones into reboot loops, with a single Android 12 handset dropping into recovery mode about every 90 seconds. Around 30 messages delivered in rapid succession can corrupt the SQLite message database, which makes the phone app crash on every boot.

Because carriers can redeliver unacknowledged texts and the system can reprocess stored messages after a restart, the crash can repeat. Cyber Security News reported that a single bad message can trigger repeated outages of up to a week, since carriers resend texts that went unacknowledged. Getting out of a reboot loop may demand a factory reset, which wipes stored data.

The researcher filed the issue with Google’s vulnerability reward program on May 5, 2026, and Google initially labeled it a non-security matter, according to Cybernews and UNDERCODE NEWS. On June 15, 2026, Google committed the fix to the Android Open Source Project. The researcher’s disclosure site says Google marked the report Won’t Fix, and GSMArena reported that Google turned down the security report in May.

Cyber Security News noted that the defenses built into Android 17, such as 2G downgrade protection and SMS blaster filters, do not stop this parsing bug. GrapheneOS stated that the November security bulletin will include the bug. Cybernews quoted Mark Blaszczyk on the impact: “A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim.”

The vulnerability hits phones on Android 12 or later, including Google Pixel and Samsung Galaxy handsets. Handsets on Android 13 or earlier that no longer get updates may stay vulnerable. BleepingComputer noted that CVE-2026-58882 is absent from Google’s October security bulletin.

Users cannot block the attack with a setting, because the system processes the message before it reaches the inbox. Supported devices get Android security updates automatically, though rollout timing varies by manufacturer and carrier and may need a restart. A GitHub contributor called Sakis developed an Android Debug Bridge approach to remove the malicious messages, though it needs a computer and some technical know-how. The October patch for Android 14 or later is the main fix, and the ADB method provides a manual cleanup for devices already caught in a loop.