Overview
A researcher has published a proof-of-concept exploit for a recently patched Android flaw dubbed "SMS of Death," tracked as CVE-2026-58882. A specially crafted text message can crash a phone or disrupt cellular service, including calls already in progress, with no user interaction.
Technical Details
- Component:
WapPushOverSms.decodeWapPdu, which parses WAP Push messages. - Root cause: A header-length value is not properly validated. Without a bounds check it overflows to a negative number, producing a
NegativeArraySizeExceptionthat crashes thecom.android.phoneprocess. - Zero-click: Android processes the message before it reaches the SMS inbox, so the victim sees nothing that explains the crash.
- Researcher: Mark Blah published the analysis and PoC. A GitHub contributor, Sakis, found an ADB-based way to remove the malicious messages.
Affected and Patched Versions
| Android version | Status |
|---|---|
| 12, 13 | Vulnerable, no fix received |
| 14 through 17 | Patched in Google's October 2026 security updates |
The flaw is not listed in Google's October security bulletin. Google's fix, "Fix remote DoS in decodeWapPdu," catches the exceptions and deletes the malicious messages from the SMS database.
Impact
Devices that receive the message may crash repeatedly or lose cellular service. In one reported case a device stuck in a reboot loop required a factory reset. Removing the messages over ADB is possible but needs a computer and technical skill.
Mitigation
- Install the latest Android security update and restart. Availability depends on your device maker and carrier.
- Devices on Android 12 or 13 should be replaced or moved to a supported release, since no fix is available.
- Organizations should inventory unsupported Android devices and note that a public PoC now exists.