- A malformed invisible SMS can crash Android’s phone service and drop active calls, including emergency calls.
- The flaw affects Android 12 through 16, and some devices may never receive a fix.
- Attackers can send repeated messages to trap phones in a reboot loop, potentially forcing users to perform a factory reset.
- Google has committed a patch, but it has not reached all supported Android devices yet.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
An invisible SMS crashes Android phones, cuts off calls, including to emergency services, and can trap users in a reboot loop, a researcher warns. The “SMS of Death” exploit code is now public, and the fix is underway.
Simply invisible SMS messages can make Android phones unusable, requiring a factory reset or an involved recovery procedure, a new security advisory warns.
“A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim,” Mark Blaszczyk, a security researcher (@sourone), said in a report.
WAP Push is a legacy system that lets mobile carriers send hidden instructions to phones without the user taking any action, such as prompting devices to download MMS or apply carrier settings.
And attackers can already leverage SMSes to target victims using a proof-of-concept “SMS of Death” app, made available on GitHub – it remotely and silently sends a crafted 8-byte WAP Push PDU over SMS to a target handset.
The bug requires no user interaction, the exploit works remotely, and often bricks the device – recovery requires connecting to the phone using Android Debug Bridge (ADB), according to the researcher. The attack is completely invisible, and the SMS messages don’t appear in the inbox.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The author disclosed the bug responsibly in May, 2026. Google committed a fix on June 15 and pushed the patch to the Android Open, but the fix has yet to reach all supported devices
The critical vulnerability affects Android 12 through 16, meaning that many phones will never receive a fix.
GrapheneOS said the bug will be included in the upcoming November security bulletin. The critical flaw is patched in Android 14–17 with the October 2026 update. It has been assigned CVE-2026-58882.
It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:https://t.co/tBoWBpALw1
— GrapheneOS (@GrapheneOS) October 29, 2026
How does the bug work?
The entire payload is just eight bytes sent header’s length
When the phone receives the SMS and starts processing it automatically, it sees a valid value: 2,147,483,648, in a format known as long (0x80000000), which is used for large numbers.
However, Android then converts it to a smaller data type, a 32-bit integer (int), without checking the range, causing overflow. The number flips to a negative value (-2,147,483,648) after conversion, which makes no sense as a header length.
The negative value triggers a fatal error, killing com.android.phone, a component that handles calls.
The victim does nothing. No tap, no open, no notification,
said the researcher.
This drops any active call, including emergency calls, without any user interaction – the victim never sees the message or the sender’s number.
The phone loses service for only about 1-2 seconds, until the com.android.phone component restarts. But then another surprise hits – carriers resend the SMS message because the phone never acknowledged receipt, making the situation worse.
The malformed message also remains queued, and the phone retries processing it on every boot, crashing on startup until it’s cleared.
Worst-case scenario – reboot loop
The attacker can send around 20 messages, leading to persistent denial of service – this would make the device unusable for an “extended period,” the researcher warns.
The poison messages sit in the pending inbound queue, and the device tries to retrieve them on every boot until Android’s RescueParty, an automatic recovery feature, reboots the device into recovery after roughly 90 seconds.
“The malformed message stays queued and is retried on every boot, so the phone can crash on startup until it is cleared,” the researcher explains.
Mark B. tested the exploit on a Pixel 9 running April 2026 firmware and on various Samsung Galaxy A-series devices, achieving a 100% reproduction rate.
You don’t have to keep an eye on this by yourself. Here’s what’s included:
- 24/7 dark web monitoring
- Credit and financial alerts
- Automatic data removal
16% off
$10.42/month
Set up protection
We may earn a commission if you buy through the link below.
*Insurance covers losses from misuse of your data after your plan starts. It doesn’t cover past breaches, including the ones shown above.
