New Android SMS of Death exploit can remotely crash unpatched phones

The recent disclosure of a "SMS of Death" vulnerability, tracked as CVE-2026-58882, presents a significant threat to Android users, particularly those with older or unpatched devices. This zero-click denial-of-service flaw allows attackers to remotely disrupt cellular service or crash phones by merely sending a specially crafted text message, requiring no interaction from the target. The insidious nature of this exploit lies in its ability to process the malicious message before it even reaches the SMS inbox, leaving victims unaware of the cause of their phone's malfunction.

CVE-2026-58882

This vulnerability, identified as CVE-2026-58882, stems from improper validation of a header-length value within Android's WapPushOverSms.decodeWapPdu function. An attacker can exploit this by sending an eight-byte malformed WAP Push message to targeted phones via a data SMS to port 2948. When a specific value within this message is translated into a signed 32-bit integer without proper bounds checking, it becomes a large negative number.

Android's attempt to allocate memory using this negative value triggers a NegativeArraySizeException, which subsequently crashes the com.android.phone process. Since this process is responsible for managing all cellular functions, its crash leads to immediate disruption of mobile connectivity, including ongoing phone calls and, critically, emergency calls. The researcher, Mark Blah, noted that repeated malicious messages could even force phones into persistent reboot loops, sometimes requiring a factory reset for recovery.

WapPushOverSms.decodeWapPdu

The core of the vulnerability resides in the WapPushOverSms.decodeWapPdu function, where the system fails to adequately validate the header-length value. This oversight allows a maliciously crafted input to bypass intended checks, leading to the negative memory allocation attempt. Google's reported fix, titled "Fix remote DoS in decodeWapPdu," addresses this by implementing exception catching mechanisms when processing malformed text messages.

Beyond preventing the initial crash, the patch also includes functionality to delete malicious messages from the SMS database. This is a crucial step, as the researcher's testing revealed that carriers attempting to redeliver malicious messages or Android trying to re-process stored messages could cause repeated crashes, exacerbating the denial-of-service effect. While Android security updates are generally automatic, their deployment is contingent on device manufacturers and carriers, often requiring a manual restart to finalize installation.

Mark Blah

Security researcher Mark Blah is credited with discovering and analyzing this critical flaw, subsequently releasing a technical analysis and a proof-of-concept exploit. Blah's work highlights a significant gap in Android's security posture, particularly concerning older devices. According to Blah, Google reportedly issued a patch for Android 14 through 17 in its October 2026 Android security updates. However, the vulnerability is conspicuously absent from Google's official October security bulletin, raising concerns about transparency and broader awareness.

Furthermore, Blah's findings indicate that older Android 12 and 13 devices did not receive this crucial fix, leaving millions of users exposed to the "SMS of Death" exploit. The public availability of a working proof-of-concept exploit, capable of sending malicious messages from another Android device, elevates the urgency for users to update their phones immediately. While a GitHub contributor, Sakis, found a method to remove malicious messages using Android Debug Bridge (ADB), this solution requires advanced technical knowledge, making it inaccessible to the average user.