A newly reported Android vulnerability, dubbed “SMS of Death” by security researcher Mark Blah, can disrupt cellular service or crash certain phones through a series of specially crafted SMS messages. The flaw is tracked as CVE-2026-58882 and does not require the recipient to open the message.
The Android system processes the malicious message before it reaches the regular inbox. According to Blah, the messages can remain queued after a reboot and be retried each time the phone starts, potentially causing repeated crashes until they are removed.
The flaw affects Android versions 12 through 16 and was observed on several devices, including Pixel 9 and Samsung Galaxy phones. It can interrupt active calls, including emergency calls, because it affects the Android process responsible for cellular functions.
The attack exploits improper validation of a header length in Android’s WapPushOverSms.decodeWapPdu function. A malformed WAP Push message can produce a negative value that the system tries to use for memory allocation, triggering a NegativeArraySizeException and crashing the com.android.phone process. The report says that 20 malicious messages are enough to trigger the crash.
Google appears to have addressed the issue in the October 2026 Android security update for versions 14 through 17. The fix catches the exceptions caused by the messages and removes them from the SMS database to prevent them from being processed repeatedly. The update does not appear to be available for devices still running Android 12 or 13.
Tom’s Guide contacted Google after the report claimed the issue had been considered a “non-priority,” but Google had not responded to its inquiries at the time of publication.
Android security updates are generally installed automatically on supported devices, although availability depends on the phone manufacturer and network carrier. Users should check whether the October update is installed and restart the phone if required to complete the process. The report indicates that the attack does not appear to be widely deployed, but a working proof of concept has been released, making it important to keep compatible devices updated.
Sources: Tom's Guide.