A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed “SMS of Death” and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message.
The zero-click denial-of-service flaw can interrupt ongoing calls, including emergency calls, without requiring any interaction from the target. What’s worse, Android processes the message before it reaches the SMS inbox, leaving victims with no visible indication of what caused their phones to crash.
According to the vulnerability researcher, Mark Blah, Google reportedly patched the vulnerability in its October 2026 Android security updates for Android 14 through 17. However, the flaw is not listed in Google’s October security bulletin, and older Android 12 and 13 devices remain vulnerable because they did not receive the fix.
Blah published a technical analysis of the flaw, caused by improper validation of a header-length value in Android’s WapPushOverSms.decodeWapPdu function.
To exploit the flaw, an attacker can send the following malformed eight-byte WAP Push message to targeted phones:
01 06 88 80 80 80 00 BE → sent as a data SMS to port 2948
When this value is translated into a signed 32-bit integer without a bounds check, it becomes -2147483648.
When Android attempts to allocate memory using this negative value, it triggers a NegativeArraySizeException that crashes the com.android.phone process.
As the com.android.phone process manages cellular functions, the crash disrupts mobile connectivity and disconnects ongoing phone calls, including calls to emergency services.
The researcher says the attack can also cause repeated crashes when carriers attempt to redeliver malicious messages or Android tries to process messages already stored on the phone.
When testing the flaw, the researcher found that sending 20 malicious messages could cause phones to get stuck in reboot loops. On one Android 12 device, the phone rebooted into recovery mode approximately every 90 seconds, requiring the user to perform a factory reset to recover.
A GitHub contributor named Sakis discovered a way to remove the malicious messages using Android Debug Bridge (ADB), but the process requires more advanced technical knowledge and access to a computer.
The researcher has published a proof-of-concept exploit that can send the malicious messages from another Android device.
Google’s fix, titled “Fix remote DoS in decodeWapPdu,” prevents the crashes by catching exceptions triggered when Android processes the malformed text messages.
The patch also deletes malicious messages from the SMS database to prevent them from triggering repeated crashes.
Android security updates are generally installed automatically on supported devices, but their availability depends on the device manufacturer and carrier, and a restart may be required to complete installation.
Now that a working proof-of-concept exploit has been released, Android users are strongly advised to install the latest security updates to protect their devices.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
