Android "SMS of Death": one silent text crashes the phone service and drops calls (CVE-2026-58882)
Android telephony framework (com.android.phone)
A researcher published a working proof-of-concept for CVE-2026-58882, nicknamed "SMS of Death", a zero-click denial-of-service flaw in Android's telephony framework. Android's WapPushOverSms.decodeWapPdu() reads a WAP Push header length and casts it to a signed 32-bit integer with no range check, so an 8-byte data SMS sent to port 2948 makes it allocate an array of size -2147483648, which throws an uncaught NegativeArraySizeException and kills com.android.phone. That drops cellular service and any active call, including emergency calls, and the message never shows up in the inbox. The researcher reports that about 20 messages can leave a phone unusable, that carrier redelivery and retries on boot keep re-crashing it, and that one Android 12 test phone fell into a recovery-mode reboot loop that needed a factory reset; clearing the queued messages otherwise takes ADB. Google's fix ("Fix remote DoS in decodeWapPdu") shipped in the October 2026 Android security update for Android 14 through 17. It catches the exception and deletes the poison message rather than adding a bounds check. Android 12 and 13 run the same code and get no fix. The flaw is not listed in Google's October bulletin, and exploitation in the wild has not been reported.
Why this severity: Zero-click remote crash of the phone service that drops active calls, including emergency calls; public PoC, and Android 12 and 13 get no fix
- Started
- Oct 29, 2026
Affected
- Android 12 through 17 before the October 2026 security update (crash reproduced on Android 12 through 16)
- Android 12 and 13 (no fix released)
Fixed in
- Android 14, 15, 16 and 17 with the October 2026 security update (AOSP commit 735d967, "Fix remote DoS in decodeWapPdu")
Timeline4
BleepingComputer reports the public exploit and notes the flaw is not listed in Google's October security bulletin.
The researcher publishes the technical write-up and a proof-of-concept sender app, noting that Android 12 and 13 stay unpatched.
Google's fix, commit 735d967 "Fix remote DoS in decodeWapPdu", ships in the October 2026 Android security release for Android 14 through 17; it catches the exception and deletes the poison message.
Researcher Mark B reports the WAP Push crash to Google's Android and Devices VRP.
Advisories2
News & write-ups1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
