Android 'SMS of Death' flaw can remotely crash phones with a single text

A newly detailed Android flaw nicknamed the "SMS of Death" can remotely crash an unpatched phone with a single text message and interrupt its calls, according to a report by BleepingComputer's Lawrence Abrams published October 31, 2026. Tracked as CVE-2026-58882, the zero-click denial-of-service issue requires no interaction from the victim and shows no visible sign of what is causing the disruption.

What happened

According to BleepingComputer, security researcher Mark Blah discovered the flaw and published a technical analysis along with a proof-of-concept exploit. The report says the issue lives in Android's telephony code and that Google has prepared a fix, but that the flaw was not listed in Google's October 2026 security bulletin. BleepingComputer reports no observed in-the-wild attacks so far, while noting that a working public proof-of-concept now exists.

Technical details

BleepingComputer reports that the flaw is in the way Android handles a WAP Push message delivered as a data SMS, specifically in the WapPushOverSms.decodeWapPdu function, which improperly validates a header-length value. When the malformed message is processed, that value is interpreted as a large negative number, and Android then attempts to allocate memory with a negative size. According to the report, this triggers a NegativeArraySizeException that crashes the com.android.phone process, which manages the device's cellular functions. The message is handled before it ever reaches the SMS inbox, so the victim sees nothing. BleepingComputer says repeated redelivery of the message can cause repeated crashes, and that in one test about 20 messages pushed an Android 12 device into a reboot loop that required a factory reset.

Who is affected

Per BleepingComputer, Google's fix was included in the October 2026 security updates for Android 14 through 17, but Android 12 and 13 devices did not receive it and remain vulnerable. As with all Android patches, when a fix actually reaches a given handset depends on the device manufacturer and the mobile carrier, so many devices may stay exposed for some time. Because the crash can interrupt active calls, including emergency calls, the report frames the practical risk as a reliability and safety problem rather than data theft.

What to do

BleepingComputer advises users to install the latest available security updates for their device. Users on Android 12 or 13, which are not slated to receive the fix, should check whether their manufacturer offers an upgrade to a patched Android version. The report also notes that a GitHub contributor using the name Sakis published an Android Debug Bridge (ADB) method to remove the malicious messages from a device, though it requires technical skill and a connected computer. Organizations that manage fleets of Android devices should prioritize updates and track which models remain on unsupported releases.