A security researcher has published a working proof-of-concept exploit for a zero-click Android denial-of-service vulnerability nicknamed “SMS of Death,” tracked as CVE-2026-58882. The flaw lets an attacker remotely crash a target phone or knock out its cellular service simply by sending a specially crafted text message, with no interaction required from the victim.

According to researcher Mark Blah, the bug is caused by improper validation of a header-length value in Android’s WapPushOverSms.decodeWapPdu function. An attacker can send an eight-byte malformed WAP Push message as a data SMS to port 2948. When that value is interpreted as a signed 32-bit integer without a bounds check, it becomes -2147483648. Android then attempts to allocate memory using this negative value, triggering a NegativeArraySizeException that crashes the com.android.phone process.

Because that process handles core cellular functions, the crash disrupts mobile connectivity and can disconnect active calls, including calls to emergency services. Since Android processes the message before it reaches the SMS inbox, victims see no visible trace of what caused the crash.

  • Repeated redelivery of the malicious message by carriers, or reprocessing of stored messages, can cause the phone to crash repeatedly.
  • Testing with 20 malicious messages sent to an Android 12 device caused it to reboot into recovery mode roughly every 90 seconds, ultimately requiring a factory reset.
  • A GitHub contributor known as Sakis found that the malicious messages can be removed using Android Debug Bridge (ADB), though this requires technical expertise and a connected computer.

Google is reported to have patched the issue in its October 2026 Android security updates for Android 14 through 17, under a fix titled “Fix remote DoS in decodeWapPdu.” The patch catches the exception during message processing and deletes the malicious message from the SMS database to prevent repeat crashes. However, the vulnerability is not listed in Google’s official October security bulletin, and Android 12 and 13 devices did not receive the fix, leaving them exposed.

With a public proof-of-concept exploit now available that can send these malicious messages from another Android device, security teams should treat this as an active risk. Android users, particularly those on older Android 12 and 13 devices, are strongly advised to confirm their security patch level and install the latest updates as soon as they become available from their device manufacturer or carrier. A device restart may be required to complete installation.