- A zero-click Android flaw let attackers crash phones with a specially crafted SMS message
- Repeated messages could trigger reboot loops, disrupt calls, and even affect emergency connectivity
- Google patched supported Android versions, but many end-of-life devices remain permanently vulnerable
Picture this: You’re talking on your Android phone when all of a sudden you just lose mobile connectivity and your phone call drops. No explanation, no notification. Soon after, it happens again. And again. At one point, the device goes into recovery mode, rebooting every minute and a half until you finally perform a factory reset.
This is not a theoretical scenario – it is a real possibility, thanks to a critical-severity vulnerability in Android tracked as CVE-2026-58882.
Google has patched the issue for newer versions of Android, but those who are past their end-of-life date will remain at risk.
Sending an evil message
The bug was discovered by security researcher Mark Blah and described as a zero-click denial of service (DoS) vulnerability. In more technical terms, it is an “improper validation of a header-length value” bug in Android’s WapPushOverSms.decodeWapPdu function. It was nicknamed “SMS of Death” because it can be exploited with no<a href="https://myappsplus.com/will-artificial-intelligence-make-caddies-a-thing-of-the-past/” title=”Will artificial intelligence make caddies a thing of the past?”>thing more than an SMS message, which the victims doesn’t even have to open (hence the ‘zero-click’ part).
As Blah discovered, a threat actor could send a malformed eight-byte WAP Push message to an Android device’s port 2948: 01 06 88 80 80 80 00 BE.
Since this is a hex message, when it gets translated into a signed 32-bit integer, it becomes -2147483648. Android can then try to allocate memory using this negative value, triggering a NegativeArraySizeException error that crashes the com.android.phone process. Since this process manages cellular functions, the call is dropped and mobile connectivity is disrupted. Even emergency services are susceptible, it was said.
It gets worse. Android processes messages before they reach the inbox, meaning the victim will not be notified of the SMS and won’t even know it’s the text message that’s crashing the system. Also, some carriers will attempt to redeliver messages that never reached the inbox, extending the agony. Android also does its part by constantly trying to process messages already stored on the phone.
Finally, Blah found that if a malicious actor sends 20 or more messages, they can force the device into a reboot loop. On an Android 12 device, they can force looped recovery mode, leaving factory reset as the only viable option.
Patching the SMS of Death
Initially, all Android versions were affected, it was said. Google patched it for versions 14 through 17, but older devices will not be getting a patch and thus will remain at risk indefinitely. The fix is called “Fix remote DoS in decodeWapPdu”, and apparently it prevents the crashes by catching exceptions triggered when Android processes malformed text messages. It also deletes these messages from the SMS database so that they don’t trigger repeat crashes.
Blah has released a proof-of-concept (PoC), showing the wider community exactly how to exploit the flaw, andBleepingComputer reported that a GitHub contributor found a way to remove the malicious message, but it requires more technical knowledge, which is something the majority of mobile phone users probably won’t have. Still, those interested in tinkering should know that it can be removed
Google apparently patched the bug in its October 2026 Android security updates, but that doesn’t automatically mean all Android users are safe. Unlike Apple’s ecosystem, Android is diversified, and different manufacturers have different update cadences.
Therefore, while we can assume Pixel users have likely already received this update, Samsung users, as well as those using Xiaomi, Motorola, or OnePlus devices, will probably have to wait a little longer until their manufacturers apply the fix to their devices and push the update.
Still, since the PoC has been released, it’s safe to assume most Android manufacturers have already pushed their updates. Users are advised to install them as soon as possible.
