Android 'SMS of Death' flaw: exploit code published for unpatched phones

What the flaw reportedly does

On 31 October 2026, Bleeping Computer reported that a security researcher had published a working proof of concept for an Android vulnerability nicknamed “SMS of Death”, tracked as CVE-2026-58882. Happy Halloween. Only one outlet is reporting this: that article, which draws on the researcher’s technical write-up. Treat what follows as reported, not confirmed.

The flaw is said to be a “zero-click” denial of service. One specially crafted data SMS would be enough to crash com.android.phone, the process that runs your phone’s cellular functions. Your mobile connection drops and any call in progress is cut off, including calls to emergency services. You don’t have to tap anything, and you won’t see anything either: Android reportedly processes the message before it ever reaches your inbox. There’s no dodgy text and no suspicious link, so nothing tells you where the crash came from. It’s a hit-and-run, carried out by text message.

A validation slip in WAP Push decoding

The problem reportedly sits in the WapPushOverSms.decodeWapPdu function, which decodes WAP Push messages. Yes, WAP: the protocol most of us assumed had been retired along with flip phones. A header length value isn’t properly validated there. It gets converted to a signed 32-bit integer with no bounds check, and it turns negative. When the system then tries to allocate memory of that size, it throws a NegativeArraySizeException and the phone process falls over. Asking for a negative amount of memory goes about as well as you’d expect.

The crash doesn’t necessarily stop at one. According to the researcher, it can happen again when the carrier tries to redeliver the message, or when Android reprocesses messages already stored on the device. In testing, 20 messages were reportedly enough to trap phones in a reboot loop. One Android 12 device restarted into recovery mode roughly every 90 seconds, and only a factory reset brought it back. A GitHub contributor has found a way to delete the offending messages with Android Debug Bridge (ADB), but it takes a computer and fairly advanced technical skills. It’s not something you could talk a relative through over the phone, especially since their phone wouldn’t be working.

Who’s exposed

According to the researcher, Google fixed the flaw in its October 2026 security updates for Android 14 to 17. The patch, titled “Fix remote DoS in decodeWapPdu”, catches the exceptions these malformed messages trigger and deletes the malicious messages from the SMS database, which stops the repeat crashes.

A few things make this messier. First, the vulnerability isn’t listed in Google’s October security bulletin, so reading the bulletin won’t tell you whether a device is protected. Second, phones on Android 12 and 13 reportedly remain vulnerable, because they never received the fix. Finally, the published proof of concept can send the booby-trapped messages from another Android device.

How to check and protect yourself

If your phone runs Android 14 to 17, check in Settings that the October 2026 security update, or a later one, is actually installed. These updates usually install themselves on supported devices, but availability depends on your manufacturer and carrier, and a restart may be needed to finish the job. If an update is waiting, restart your phone.

For phones on Android 12 or 13, the source mentions no fix. Just be aware that repeated mobile network dropouts or endless reboots may come from this flaw, even if no message ever shows up in your SMS app.

Now that the proof of concept is public, an update that’s downloaded but not applied protects nothing. Only a restart makes it take effect. The oldest advice in IT now has a CVE number attached: turn it off and on again.