A security researcher has published a proof‑of‑concept exploit for a recently patched Android flaw known as “SMS of Death,” identified as CVE‑2026‑58882. The exploit allows an attacker to send a specially crafted text message that can remotely crash a phone’s cellular subsystem, interrupting ongoing calls—including emergency calls—without any interaction from the target.
How the vulnerability works
The defect resides in Android’s WapPushOverSms.decodeWapPdu function, where a header‑length value is not properly validated. By transmitting an eight‑byte WAP Push message—hexadecimal sequence 01 06 88 80 80 80 00 BE—as a data SMS to port 2948, the attacker forces Android to interpret the value as a signed 32‑bit integer of -2147483648. When the system attempts to allocate memory using this negative number, it throws a NegativeArraySizeException, crashing the com.android.phone process that controls cellular functions. The crash severs mobile connectivity and can drop any active call, including calls to emergency services.
Because Android processes the message before it reaches the SMS inbox, victims receive no visible indication that a text triggered the failure. The researcher, identified as Mark Blah, noted that the attack can be repeated when carriers try to redeliver the malicious message or when Android reprocesses messages already stored on the device.
Impact on devices and mitigation
Testing demonstrated that sending as few as 20 malformed messages could lock a phone in a reboot loop. On an Android 12 device, the phone entered recovery mode roughly every 90 seconds, forcing the user to perform a factory reset to regain functionality. A GitHub contributor known as Sakis discovered a method to purge the malicious messages using Android Debug Bridge (ADB), but the technique requires advanced technical knowledge and a connected computer.
Google addressed the flaw in its October 2026 security updates for Android versions 14 through 17, releasing a patch titled “Fix remote DoS in decodeWapPdu.” The fix catches the exception that would otherwise crash the system and also removes the offending messages from the SMS database to prevent repeated failures. However, the vulnerability is not listed in Google’s public October security bulletin, and devices running Android 12 and 13 did not receive the fix, leaving them exposed.
Android security updates are typically installed automatically on supported devices, but rollout depends on individual manufacturers and carriers, and a device restart may be required to complete installation. Given that a working proof‑of‑concept exploit is now publicly available, users of affected Android versions are strongly urged to verify that they have received the October 2026 update and to apply it promptly.
Mark Blah also released a PoC tool that can send the malicious WAP Push messages from another Android device, demonstrating that the attack can be launched without specialized hardware. The existence of this tool underscores the urgency for users and enterprise IT teams to confirm patch deployment across all managed Android devices.
Mitchell Landsberg is a Senior Technology Correspondent at News Raise. He covers consumer electronics, artificial intelligence, software developments, and digital privacy trends.
