New Android 'SMS of Death' Exploit Can Remotely Crash Unpatched Phones

Overview of CVE-2026-58882

A security researcher has published a proof-of-concept exploit for an Android vulnerability tracked as CVE-2026-58882 and dubbed the "SMS of Death." According to the reported findings, the zero-click denial-of-service flaw allows an attacker to remotely disrupt cellular service or crash vulnerable mobile devices by transmitting a specially crafted text message.

Because Android processes the message before it reaches the standard SMS inbox, victims reportedly receive no visible notification or indication of what caused the disruption. Security analysis indicates the issue stems from improper validation of a header-length value within Android's `WapPushOverSms.decodeWapPdu` function.

Practical Implications and Technical Impact

When a malicious eight-byte WAP Push message is translated into a signed 32-bit integer without adequate bounds checking, it evaluates to `-2147483648`. When the system attempts memory allocation using this negative value, it triggers a `NegativeArraySizeException` that terminates the `com.android.phone` process.

Reported consequences include:

• Interruption of ongoing cellular and emergency calls.
• Loss of mobile connectivity.
• Potential boot loops or forced recovery mode requiring a factory reset if multiple malicious messages trigger repeated crashes during redelivery attempts.

Mitigation and Verification

According to the reported details, Google addressed the issue in its October security updates for Android versions 14 through 17 via a patch titled "Fix remote DoS in decodeWapPdu." However, the flaw reportedly remains unpatched on older devices running Android 12 and 13.

Users seeking to verify their device status and protect against potential exploits should review the following steps:

• Check Update Status: Navigate to device settings to confirm whether the latest system and security updates are installed.
• Understand Limitations: Automatic update availability often depends on the specific device manufacturer and cellular carrier.
• Advanced Recovery: While a GitHub contributor identified a method to remove malicious messages using Android Debug Bridge (ADB), the process requires a computer and technical proficiency.