Researcher Publishes 'SMS of Death' Exploit for Patched Android Flaw

A security researcher known as Mark Blah has released a working proof-of-concept exploit for an Android vulnerability that can knock phones offline through a single text message, according to BleepingComputer. The flaw, tracked as CVE-2026-58882 and nicknamed "SMS of Death," allows an attacker to disrupt cellular service or crash a device remotely. No action from the person receiving the message is needed.

According to BleepingComputer, the attack can cut short calls already in progress, including calls to emergency services. Android handles the message before it ever reaches the SMS inbox, so users see no sign of what caused the crash.

The underlying bug sits in a function called WapPushOverSms.decodeWapPdu. Blah's technical analysis traces it to a header-length value that the code fails to validate properly. When the value is converted to a 32-bit signed integer, it turns into -2147483648. Android then tries to reserve memory using that negative figure, which throws a NegativeArraySizeException and brings down the com.android.phone process.

That process handles cellular functions, so its failure drops mobile connectivity and ends ongoing calls. Blah says the disruption can repeat itself when carriers attempt to redeliver the malicious messages or when Android processes copies already saved on the device. During testing, 20 crafted messages were enough to trap phones in reboot loops. One Android 12 handset restarted into recovery mode roughly every 90 seconds, and only a factory reset brought it back.

Google reportedly addressed the issue in its October 2026 security updates covering Android 14 through 17, though the flaw does not appear in the company's October bulletin. Devices still running Android 12 or 13 did not receive the fix and remain exposed. The patch, described as "Fix remote DoS in decodeWapPdu," catches the exceptions raised by malformed messages and also clears the offending texts from the SMS database to stop repeat crashes.

A GitHub contributor named Sakis found a way to strip the malicious messages using Android Debug Bridge, but that route calls for a computer and more advanced technical knowledge. Android updates usually install on their own on supported devices, yet availability varies by manufacturer and carrier, and a restart may be needed to finish. With an exploit now public, Blah and BleepingComputer advise users to install the latest security updates.