A security researcher has published a working exploit for an Android flaw that can crash a phone with a single text message the victim never sees. Dubbed the "SMS of Death" and tracked as CVE-2026-58882, the zero-click denial-of-service vulnerability lets an attacker remotely disrupt cellular service or crash an unpatched phone simply by sending a specially crafted message.
What makes the flaw particularly serious is that it needs no interaction at all. The victim does not have to open the message, tap a link or download anything. Android processes the message before it ever reaches the SMS inbox, so there is no visible warning and no trace of what caused the crash.
How one malformed message breaks the phone
The flaw sits in how Android handles WAP Push messages, an older SMS format that mobile networks still use behind the scenes for things like multimedia-message notifications and carrier settings. Unlike ordinary texts, WAP Push messages are decoded automatically by the operating system.
According to researcher Mark Blaszczyk's published analysis, the bug is an improper validation of a header-length value in Android's WapPushOverSms.decodeWapPdu function. An eight-byte malformed message sent as a data SMS to port 2948 makes Android read a value that, converted to a signed 32-bit integer without a bounds check, becomes negative. Android then tries to allocate memory of that negative size, triggering an error that crashes the com.android.phone process — the system process that manages calls and cellular connectivity.
When that process crashes, any call in progress is cut off, including calls to emergency services, and the phone temporarily loses mobile service while Android restarts the process. The damage scales with repetition: in testing, sending about 20 malicious messages could leave a phone stuck in reboot loops, and one Android 12 test device restarted into recovery mode roughly every 90 seconds until it was factory-reset. Redelivered or stored messages can also keep triggering crashes.
Who is still at risk
The vulnerable code dates back to Android 12, and Blaszczyk reproduced the crash every time on a Pixel 9 and several Samsung Galaxy phones. Google has reportedly fixed the flaw in its October 2026 Android security updates for Android 14 through 17, but Android 12 and 13 devices did not receive the fix and remain vulnerable. The flaw does not appear in Google's October security bulletin, though it is reportedly scheduled for the November bulletin.
There are no confirmed attacks in the wild so far, and the research demonstrates a loss of availability rather than a data breach: nothing in the disclosure suggests the flaw lets an attacker steal personal information or take control of a phone. Still, the proof-of-concept exploit is now public and can be sent from another Android device.
Blaszczyk first reported the issue to Google in May 2026, but it was initially classified as a non-security issue before Android engineers built the fix.
What to do now
There is no setting that blocks WAP Push messages, so installing the latest security update is the only real protection for supported phones. Google's fix also deletes malicious messages from the SMS database so they cannot trigger repeated crashes. Owners of phones still on Android 12 or 13 should check with their manufacturer for any further update — and, if none is coming, treat an upgrade as the safest option.
Until then, the advice is simple: keep your phone updated, and if calls start dropping for no apparent reason, do not assume it is just bad signal — the cause could be a text you never saw.
