Android ‘SMS of Death’ Exploit Released, Unpatched Phones at Risk

A security researcher has released a proof-of-concept (PoC) exploit for a critical Android vulnerability, dubbed ‘SMS of Death’, that allows attackers to remotely crash unpatched phones or disrupt cellular service using a specially crafted text message.

The flaw, tracked as CVE-2026-58882, is a zero-click denial-of-service (DoS) vulnerability, meaning it can interrupt ongoing calls, including emergency services, without any interaction required from the target device owner.

Security researcher Mark Blah, who identified the issue, explained that Android processes the malicious message before it reaches the SMS inbox, leaving victims with no visible indication of what caused their device to crash.

Technical Details of the ‘SMS of Death’ Vulnerability

The vulnerability stems from an improper validation of a header-length value within Android’s WapPushOverSms.decodeWapPdu function. An attacker can exploit this by sending a malformed eight-byte WAP Push message as a data SMS to port 2948.

When this specific value is translated into a signed 32-bit integer without a bounds check, it results in a negative value. Android’s subsequent attempt to allocate memory using this negative value triggers a NegativeArraySizeException, which crashes the com.android.phone process.

As the com.android.phone process manages all cellular functions, its crash immediately disrupts mobile connectivity and disconnects any active phone calls. Repeated malicious messages can cause phones to get stuck in reboot loops, with one Android 12 device reportedly rebooting into recovery mode every 90 seconds, necessitating a factory reset to recover.

Patch Status and User Guidance

Google reportedly issued a fix for the vulnerability, titled ‘Fix remote DoS in decodeWapPdu’, as part of its October 2026 Android security updates, covering Android versions 14 through 17. The patch prevents crashes by catching the exceptions triggered during the processing of malformed text messages and also deletes malicious messages from the SMS database to prevent repeated crashes.

However, the flaw was not listed in Google’s official October security bulletin, and critically, older Android 12 and 13 devices remain vulnerable as they did not receive the fix.

Android security updates are typically installed automatically on supported devices, but availability can depend on the device manufacturer and carrier. A device restart may also be required to complete the installation. Given the release of a working PoC exploit, users are strongly advised to install the latest security updates available for their devices to protect against this threat.

For devices caught in persistent reboot loops, advanced technical knowledge and access to a computer may be required to remove the malicious messages using Android Debug Bridge (ADB), as discovered by a GitHub contributor named Sakis. In many cases, a factory reset might be the only practical solution for affected older devices.

Users can typically check for and apply updates by navigating to Settings > System > System update on their Android device. More information on Android’s security update process and security bulletins is available from Google.