New Android SMS of Death exploit can remotely crash unpatched phones

A security researcher has published a proof-of-concept exploit for a recently patched Android vulnerability, dubbed “SMS of Death” and tracked as CVE-2026-58882, that allows attackers to remotely disrupt cellular service or crash phones by sending a specially crafted text message.

The zero-click denial-of-service flaw can interrupt ongoing calls, including emergency calls, without requiring any interaction from the target. Worse yet, Android processes the message before it reaches the SMS inbox, leaving victims with no visible indication of what caused their phone to crash.

According to vulnerability researcher Mark Blah, Google patched the vulnerability in its October 2026 Android security updates for Android 14 through 17. However, the flaw is not listed in Google’s October security bulletin, and older Android 12 and 13 devices remain vulnerable because they did not receive the patch.

Blah published a technical analysis of the flaw, caused by incorrect validation of a header length value in Android’s WapPushOverSms.decodeWapPdu function.

To exploit this flaw, an attacker can send the following malformed eight-byte WAP Push message to targeted phones:

01 06 88 80 80 80 00 BE   → sent as a data SMS to port 2948

When this value is translated to a 32-bit signed integer without bounds checking, it becomes -2147483648.

When Android attempts to allocate memory using this negative value, it throws a NegativeArraySizeException which crashes the com.android.phone process.

While the com.android.phone process handles cellular functions, the crash disrupts mobile connectivity and disconnects ongoing phone calls, including calls to emergency services.

The researcher says the attack can also cause repeated crashes when carriers try to resend malicious messages or Android tries to process messages already stored on the phone.

When testing the flaw, the researcher discovered that sending 20 malicious messages could get phones stuck in reboot loops. On an Android 12 device, the phone rebooted into recovery mode approximately every 90 seconds, forcing the user to perform a factory reset to recover.

A GitHub contributor named Sakis discovered a way to remove malicious messages using Android Debug Bridge (ADB), but the process requires more advanced technical knowledge and access to a computer.

The researcher published a proof-of-concept exploit capable of sending malicious messages from another Android device.

Google’s fix, titled “Fix Remote DoS in decodeWapPdu,” prevents crashes by detecting exceptions thrown when Android processes malformed text messages.

The fix also removes malicious messages from the SMS database to prevent them from triggering repeated crashes.

Android security updates are usually installed automatically on supported devices, but their availability depends on the device manufacturer and carrier, and a reboot may be required to complete the installation.

Now that a working proof-of-concept exploit has been released, Android users are strongly advised to install the latest security updates to protect their devices.