A security researcher has published a proof-of-concept exploit for a recently patched Android vulnerability known as “SMS of Death” and tracked as CVE-2026-58882. The flaw can let an attacker remotely disrupt cellular service, disconnect active calls—including emergency calls—or crash a phone simply by sending a specially crafted text message, without requiring any action from the recipient.
Android flaw can crash phones without user interaction
The vulnerability is a zero-click denial-of-service flaw. Android processes certain messages before they appear in the SMS inbox, meaning victims may have no visible indication of what caused their phone to crash.
According to vulnerability researcher Mark Buller, Google patched the vulnerability in the October 2026 Android Security Update. However, the flaw was not mentioned in Google’s October security bulletin, and older devices running Android 12 and Android 13 remain vulnerable if they have not received the fix.
The technical analysis attributes the vulnerability to improper validation of the header-length value in Android’s WapPushOverSms.decodeWapPdu function.
How the “SMS of Death” exploit works
An attacker can exploit the flaw by sending the following malformed eight-byte WAP push message to a targeted phone as a data SMS on port 2948:
01 06 88 80 80 80 00 BE → sent as a data SMS to port 2948When the value is converted to a signed 32-bit integer without bounds checking, it becomes -2147483648. Android then attempts to allocate memory using the negative value, triggering a NegativeArraySizeException and crashing the com.android.phone process.
The com.android.phone process manages mobile phone functionality, so its crash can disrupt cellular connectivity and disconnect ongoing calls, including calls to emergency services.
Researchers said the attack may also cause repeated crashes if a carrier attempts to redeliver the malicious messages or Android processes messages that are already stored on the device.
Multiple messages can cause a reboot loop
During testing, researchers found that sending 20 malicious messages could place a phone in a reboot loop. On one Android 12 device, the phone rebooted into recovery mode approximately every 90 seconds and required a factory reset to recover.
A GitHub contributor named Sakis discovered a way to remove the malicious messages using Android Debug Bridge (ADB). However, the procedure requires technical knowledge and access to a computer.
The researchers have published a proof-of-concept exploit. The exploit can be used to send malicious messages from another Android device.
Google’s patch and recommended protection
Google’s fix, titled “Fix remote DoS in DecodeWapPdu,” prevents the crash by catching the exception triggered when Android processes a malformed text message.
The patch also removes malicious messages from the SMS database, preventing them from causing repeated crashes.
Android security updates typically install automatically on supported devices, but availability varies by manufacturer and carrier. A restart may also be required to complete the installation. With a working proof-of-concept exploit now available, Android users should install the latest security update supported by their device.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop dramatically.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com