‘SMS of Death’ flaw can remotely crash unpatched Android phones - Hardware, PCs and semiconductors

A zero-click Android vulnerability allows specially crafted SMS messages to disrupt mobile connectivity and potentially force affected devices into reboot loops. Google has patched supported versions, while end-of-life phones remain vulnerable.

A critical Android vulnerability tracked as CVE-2026-58882 can allow an attacker to crash a phone remotely by sending a specially crafted SMS message. The exploit requires no interaction from the recipient, including opening the message.

Security researcher Mark Blah described the issue as a zero-click denial-of-service vulnerability and nicknamed it “SMS of Death.” The flaw involves improper validation of a header-length value in Android’s WapPushOverSms.decodeWapPdu function. A malformed eight-byte WAP Push message sent to port 2948 can cause Android to process a negative memory-allocation value, triggering an error that crashes the com.android.phone process.

Because that process handles cellular functions, an affected device can lose mobile connectivity and drop calls. The vulnerability may also affect emergency connectivity. Android processes these messages before they reach the inbox, so victims may receive no notification or indication that an SMS caused the disruption.

Repeated delivery attempts by some carriers, along with Android’s continued efforts to process messages stored on the device, can extend the problem. Blah found that sending 20 or more malicious messages could force a device into a reboot loop. On Android 12, the phone could enter a repeated recovery mode, potentially leaving a factory reset as the only practical remedy.

Google initially identified the issue across Android versions and patched supported releases from Android 14 through Android 17. The fix, included in the October 2026 Android security updates, catches exceptions generated while processing malformed messages and removes those messages from the SMS database to prevent repeated crashes.

However, devices that have reached end of life will not receive the patch and remain permanently exposed. Android manufacturers also distribute updates on different schedules, so users should install available security updates as soon as possible.

A proof of concept for the vulnerability has been released. A method for removing the malicious message using Android Debug Bridge exists, but it requires technical knowledge and connecting the device to a computer.

Sources: TechRadar.