SMS of Death: an invisible text message crashes Android

A single text message, which never shows up in the inbox and requires no action from the recipient, is enough to kill the process that runs Android telephony, drop ongoing calls, including calls to emergency numbers, and, if repeated, make the phone unusable. The vulnerability, nicknamed “SMS of Death” and tracked as CVE-2026-58882, was documented by an independent researcher who also released a proof-of-concept exploit. It was covered by heise Security (30 October), BleepingComputer (31 October) and Security Affairs (1 November).

What happened

According to the researcher, quoted by BleepingComputer, Google fixed the flaw in the October 2026 security updates for Android 14, 15, 16 and 17, although the fix was not listed in the October bulletin. Security Affairs instead reports a GrapheneOS post of 29 October stating that the CVE is rated Critical in the November 2026 Android Security Bulletin. On Android 12 and 13, where according to the researcher the vulnerable code is present, the fix has not arrived: these devices remain exposed.

With a public exploit the attack requires no special skills: according to BleepingComputer, the proof of concept sends the malicious messages from another Android device.

Technical details

The flaw lies in the WapPushOverSms component of the Android telephony framework (frameworks/opt/telephony), which parses WAP Push messages: binary SMS processed automatically by the system, with no user interaction.

• Root cause: the decodeWapPdu() function reads the WSP header length, encoded as a uintvar, into a 64-bit value and casts it to a signed 32-bit integer without a range check.
• Trigger: a 5-byte uintvar (88 80 80 80 00) decodes to 0x80000000, which as a signed 32-bit integer becomes -2147483648. Allocating an array of that size throws an unhandled NegativeArraySizeException on the telephony main thread and kills the com.android.phone process.
• Vector: a data SMS sent to WAP Push port 2948; according to BleepingComputer the whole message is eight bytes long. It is processed before it reaches the SMS inbox: no notification and no visible sender.
• Effect of a single message: according to the analysis reported by Security Affairs, each processing run interrupts phone service for one to two seconds while the component restarts; ongoing calls are dropped.
• Persistence: the message can stay in the incoming SMS queue and be processed again, and carrier redelivery attempts repeat the crash. The researcher reports intermittent crashes for up to a week after a single message. Around twenty messages can push the phone into a reboot loop: on one Android 12 device, BleepingComputer writes, the phone rebooted into recovery mode roughly every 90 seconds and had to be factory reset.
• Tested devices: according to Security Affairs, the issue is reproducible on the Google Pixel 9 and on Samsung Galaxy and Galaxy A smartphones.

There is no code execution and no data theft: the target is the availability of phone service. In the MITRE ATT&CK Mobile matrix the effect falls under the Impact tactic, technique T1464 (Network Denial of Service).

Google’s fix, titled “Fix remote DoS in decodeWapPdu”, catches the exceptions raised by malformed messages and deletes the malicious messages from the SMS database, so they cannot trigger further crashes.

Impact on businesses

For a company the risk is not data loss but reachability. Anyone who knows the number of a company phone can drop its calls or, with more messages, make it unusable for days, leaving no visible trace for the user. The most exposed are:

• phones of on-call staff, field technicians and managers who must be reachable during an incident;
• healthcare and emergency services, where a dropped call or an unreachable doctor has direct consequences, all the more since the flaw also affects calls to emergency numbers;
• Android 12 and 13 devices still in use, which according to the sources have not received the fix.

For NIS2 entities, mobile device management falls within the measures on asset inventory and vulnerability handling: unpatched phones in critical roles are a risk to document and treat.

What to do now

1. Check the patch level of every company Android device, from your mobile device management console or from Settings › Security. According to the researcher, at least the October 2026 update is needed; also check the November 2026 bulletin cited by GrapheneOS and your vendor’s notes, because update availability depends on the manufacturer and the carrier.
2. Install and restart: updates may need a restart to complete.
3. Replace or reassign Android 12 and 13 devices used by on-call staff, healthcare personnel and roles that must stay reachable.
4. Prepare for recovery: a GitHub contributor found a way to delete the malicious messages with Android Debug Bridge (ADB), which requires a computer and technical skills; the alternative is a factory reset. Make sure company data on phones can be recovered.
5. Watch for symptoms: treat repeated dropped calls, recurring loss of signal and series of reboots reported by users as suspicious, especially on unpatched devices. You can also ask your carrier whether it filters malformed WAP Push data SMS sent to port 2948.

Last updated: 1 November 2026