Android SMS of Death exploit can remotely crash unpatched phones

A security researcher has published a proof-of-concept exploit for a recently patched Android vulnerability known as “SMS of Death.” Tracked as CVE-2026-58882, the flaw allows an attacker to send a specially crafted text message that can disrupt cellular connectivity or crash the target phone remotely.

The attack requires no interaction from the recipient. Android processes the message before it reaches the SMS inbox, so the victim may receive no visible indication of what triggered the failure. The crash can interrupt ongoing calls, including emergency calls.

According to researcher Mark Blah, the vulnerability results from improper validation of a header-length value in Android’s WapPushOverSms.decodeWapPdu function. A malformed eight-byte WAP Push message sent as a data SMS to port 2948 can be interpreted as the signed 32-bit value -2147483648. Android then attempts to allocate memory using that negative value, triggering a NegativeArraySizeException in the com.android.phone process.

Because that process manages cellular functions, the failure can disconnect calls and interrupt mobile service. The researcher also found that repeated processing or redelivery of the malicious messages can cause further crashes. In testing, 20 messages left some phones in reboot loops. One Android 12 device entered recovery mode approximately every 90 seconds and required a factory reset to recover.

Blah said Google addressed the issue in its October 2026 security updates for Android versions 14 through 17. However, the vulnerability does not appear in Google’s October security bulletin, and Android 12 and 13 devices remain exposed if they have not received the fix.

Google’s patch, titled “Fix remote DoS in decodeWapPdu,” catches the exceptions generated while processing malformed messages. It also removes the malicious messages from the SMS database to prevent repeated crashes.

A GitHub contributor identified a method to remove the messages through Android Debug Bridge, although that approach requires a computer and more advanced technical knowledge. The newly released proof of concept can send the malicious messages from another Android device.

Android security updates are usually installed automatically on supported phones, but delivery depends on the device manufacturer and carrier, and a restart may be needed to complete installation. Users are advised to install the latest available security updates, particularly now that a working exploit has been published.

Sources: BleepingComputer.