As noted by Bleeping Computer, a security researcher has released a proof-of-concept exploit for a critical Android vulnerability known as the SMS of Death. This zero-click flaw, tracked as CVE-2026-58882, allows attackers to remotely disrupt cellular service or crash devices by sending a specially crafted text message.
The vulnerability stems from improper validation of a header-length value within the Android WapPushOverSms.decodeWapPdu function. By sending a malformed eight-byte WAP Push message, an attacker can trigger a NegativeArraySizeException, which crashes the com.android.phone process. Because this process manages cellular connectivity, the attack disconnects ongoing calls, including those to emergency services. The exploit is particularly dangerous because it processes the message before it reaches the SMS inbox, leaving the victim unaware of the cause. While Google released a patch in its October 2026 security updates for Android 14 through 17, older devices running Android 12 and 13 remain exposed. In some instances, repeated malicious messages can force devices into continuous reboot loops, necessitating a factory reset. Although a contributor identified a method to remove these messages using the Android Debug Bridge, the process requires advanced technical skills. Users are urged to install the latest security updates immediately to mitigate risks, as the availability of these patches often depends on specific device manufacturers and mobile carriers.
