Android ‘SMS of Death’ flaw crashes phones, drops emergency calls

A newly disclosed Android vulnerability lets attackers crash a victim's phone and cut off active calls, including calls to emergency services, using nothing more than a specially crafted text message. The flaw, tracked as CVE-2026-58882 and nicknamed “SMS of Death,” requires no interaction from the victim: the malicious message never even reaches the inbox before it does its damage, as reported by BleepingComputer.

Security researcher Mark Blaszczyk found the bug in Android's WapPushOverSms component, which handles WAP Push messages delivered over the cellular network. The code reads a message's header-length value and converts it without validating the result. A five-byte sequence can force that conversion to produce a negative number, which triggers a NegativeArraySizeException when Android tries to allocate memory for it. That exception crashes com.android.phone, the system process responsible for calls and telephony. Blaszczyk reported a 100% reproduction rate on both Google Pixel and Samsung Galaxy test devices.

The attack matters because of how invisible it is. The malicious message sits in Android's pending-message queue rather than the visible inbox, so the victim sees no notification, no sender number, and no obvious cause for the crash. Telephony typically restarts within one to two seconds, but carriers can resend an unacknowledged message, re-triggering the crash on a loop. Blaszczyk told BleepingComputer that around 20 malicious messages can leave a device effectively unusable for an extended period, since each restart attempt re-reads the same poisoned queue entry.

Blaszczyk privately reported the flaw to Google on May 5, 2026, and Google committed an engineering fix on June 15, 2026. Rather than adopt the researcher's proposed fix of validating the header length directly, Google's patch wraps the decoding routine in broader exception handling that catches the crash and deletes the malformed message from the queue. That fix shipped in the October 2026 Android security update for Android 14 through 17 — but Android 12 and 13, both still short of end-of-life, were left out of the patch rollout and remain exposed. CVE-2026-58882 was also not listed in Google's public October bulletin, so administrators scanning bulletins for the fix would not have found it there.

The gap is not small. Android 12 and 13 together account for roughly a quarter of all active Android devices worldwide, according to StatCounter's most recent version-share data, putting the vulnerable population in the hundreds of millions. GrapheneOS, the privacy-focused Android fork, said its fix will ship with its November security bulletin after earlier distribution through security previews. Owners of unpatched devices have no software-side defense beyond installing the update once their manufacturer or carrier releases it; recovering a crash-looping phone currently requires either waiting out the loop or using Android Debug Bridge to manually clear the malicious message, a step far outside what most users can do on their own.

For carriers and enterprise device managers, the flaw is a reminder that WAP Push, a decades-old SMS delivery mechanism still used for provisioning and carrier messages, remains a live attack surface on modern phones. Until patches are universal, anyone on an older Android build is dependent on carrier-level filtering rather than on-device protection — a gap attackers can exploit in bulk against phones that will never see an update.