Late last week, a report popped up about a new Android phone exploit the security researcher dubbed “SMS of Death.” Per the report, the attack, tracked as “CVE-2026-58882,” lets malicious actors disrupt cellphone service or crash Android phones by overloading them with a repeating crafted SMS text message.
The denial-of-service flaw can even interrupt ongoing calls, including emergency calls, without requiring you to open the message. Apparently, the Android operating system processes the message before it even reaches your text message inbox, meaning you wouldn’t immediately understand what caused the phone to crash.
Researcher Mark Blah says that even if you reboot your phone, the hacked message “stays queued and is retried on every boot, so the phone can crash on startup until it is cleared (recovery below).”
Upon finding Blah’s report, Tom’s Guide reached out to Google because the report claimed that Google had deemed it a “non-priority.” Google has not yet responded to our inquiries.
However, some Android phones may already have the exploit patched.
October patch
Blah’s report found that the exploit affects Android versions 12 up to 16 and was discovered on multiple devices, including Pixel 9s and Samsung Galaxy phones.
It appears Google patched the exploit in the October 2026 Android security update (if you haven’t updated your Android phone, you should). However, that’s only for Android versions 14 through 17. It does not appear to be available for any devices still running Android 12 or 13.
Per Blah, the flaw uses an improper validation of a header length in the Android WapPushOverSms.decodeWapPdu function. Attacks send a malformed WAP Push message to the targeted phone.
When this message is translated, it turns into a negative value that Android attempts to allocate memory for, which triggers a NegativeArraySizeException that crashes the com.android.phone process.
That process manages cellular functions, which disrupts connectivity and disconnects calls. This causes repeated crashes because the network tries to redeliver the malicious messages, which stack up and force Android to process each one. It only takes 20 bad messages to cause the crash.
Per the Google fix, the crash is prevented by catching the exceptions triggered by the attack messages. Then the patch deletes the messages from the SMS database to prevent them from looping.
What you need to do
Android security updates are generally automatically installed on supported devices. So you should already have them.
However, availability does depend on the phone maker and network carrier. So you should check your phone to see if the October patch has been applied. A restart may be required to complete the installation.
For the most part, this isn’t an attack you can do anything about, but based on the patch notes and Blah’s report, it doesn’t seem to be widely deployed; instead, it appears to target individual phones. Since a working proof-of-concept of the exploit has been released, the best thing you can do is make sure you keep your phone up to date.
- Now is the perfect time for Samsung to release a cheaper Galaxy Z Fold 9 FE — and it’s all because of iPhone Duo
- 3 Android Auto apps that do what Google Maps and Waze can’t
- iPhone Duo vs. Samsung Galaxy Z Fold 8: Which foldable is the best?
