Overview
A security researcher has detailed a new Android vulnerability dubbed the "SMS of Death." Tracked as CVE-2026-58882, the attack allows malicious actors to disrupt cellular service or crash Android devices by bombarding them with specifically crafted text messages.
This denial-of-service flaw can interrupt active phone calls, including emergency calls, without requiring the user to open the message. The Android operating system processes the incoming data before it reaches the user's message inbox, hiding the source of the crash.
According to researcher Mark Blah, rebooting the device does not immediately solve the issue because the malicious message remains queued. It continues to trigger crashes upon startup until cleared.
Google was contacted regarding the classification of the report, but has not yet responded.
However, security updates have already addressed the vulnerability for many modern Android devices.
Impact and Vulnerability Details
The exploit affects Android versions 12 through 16 and has been identified on multiple devices, including Google Pixel and Samsung Galaxy phones.
Google deployed a fix in the October 2026 Android security update for devices running Android versions 14 through 17. Devices still running Android 12 or 13 do not appear to have the patch available.
The vulnerability stems from improper header length validation within the Android WapPushOverSms.decodeWapPdu function. Attackers transmit a malformed WAP Push message to the target device.
Upon translation, the header size resolves to a negative value, causing Android to allocate incorrect memory. This triggers a NegativeArraySizeException that crashes the com.android.phone process.
Because that process handles cellular functions, the crash results in lost connectivity and dropped calls. Network redelivery attempts stack up the malicious messages, creating a continuous crash loop that requires as few as 20 messages to trigger.
The Google patch prevents the crash by catching the generated exceptions and deleting the malicious messages from the SMS database before they can loop.
How to Protect Your Phone
Android security updates generally install automatically on supported hardware, meaning many users may already be protected.
However, patch availability can vary depending on the device manufacturer and network carrier. Users should manually check their system settings to confirm whether the October patch has been applied.
While the exploit does not appear to be widely deployed in the wild, a working proof-of-concept has been released. Keeping your device software up to date remains the primary defense.
