{
  "slug": "android-sms-of-death-wap-push-dos-cve-2026-58882",
  "category": "patch",
  "title": "Android \"SMS of Death\": one silent text crashes the phone service and drops calls (CVE-2026-58882)",
  "summary": "A researcher published a working proof-of-concept for CVE-2026-58882, nicknamed \"SMS of Death\", a zero-click denial-of-service flaw in Android's telephony framework. Android's WapPushOverSms.decodeWapPdu() reads a WAP Push header length and casts it to a signed 32-bit integer with no range check, so an 8-byte data SMS sent to port 2948 makes it allocate an array of size -2147483648, which throws an uncaught NegativeArraySizeException and kills com.android.phone. That drops cellular service and any active call, including emergency calls, and the message never shows up in the inbox. The researcher reports that about 20 messages can leave a phone unusable, that carrier redelivery and retries on boot keep re-crashing it, and that one Android 12 test phone fell into a recovery-mode reboot loop that needed a factory reset; clearing the queued messages otherwise takes ADB. Google's fix (\"Fix remote DoS in decodeWapPdu\") shipped in the October 2026 Android security update for Android 14 through 17. It catches the exception and deletes the poison message rather than adding a bounds check. Android 12 and 13 run the same code and get no fix. The flaw is not listed in Google's October bulletin, and exploitation in the wild has not been reported.",
  "cveIds": [
    "CVE-2026-58882"
  ],
  "product": "Android telephony framework (com.android.phone)",
  "stacks": [],
  "tags": [
    "android",
    "google",
    "zero-click",
    "dos"
  ],
  "severity": "high",
  "severityNote": "Zero-click remote crash of the phone service that drops active calls, including emergency calls; public PoC, and Android 12 and 13 get no fix",
  "status": "live",
  "startedAt": "2026-10-29",
  "patchStatus": "partial",
  "affectedVersions": [
    "Android 12 through 17 before the October 2026 security update (crash reproduced on Android 12 through 16)",
    "Android 12 and 13 (no fix released)"
  ],
  "fixedVersions": [
    "Android 14, 15, 16 and 17 with the October 2026 security update (AOSP commit 735d967, \"Fix remote DoS in decodeWapPdu\")"
  ],
  "timeline": [
    {
      "date": "2026-05-05",
      "title": "Researcher Mark B reports the WAP Push crash to Google's Android and Devices VRP.",
      "sourceUrl": "https://smsofdeath.com/"
    },
    {
      "date": "2026-10",
      "title": "Google's fix, commit 735d967 \"Fix remote DoS in decodeWapPdu\", ships in the October 2026 Android security release for Android 14 through 17; it catches the exception and deletes the poison message.",
      "sourceUrl": "https://smsofdeath.com/"
    },
    {
      "date": "2026-10-29",
      "title": "The researcher publishes the technical write-up and a proof-of-concept sender app, noting that Android 12 and 13 stay unpatched.",
      "sourceUrl": "https://github.com/MarkBlah/smsofdeath/"
    },
    {
      "date": "2026-10-31",
      "title": "BleepingComputer reports the public exploit and notes the flaw is not listed in Google's October security bulletin.",
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/"
    }
  ],
  "grouping": "none",
  "sources": [
    {
      "kind": "advisory",
      "title": "SMS of Death: zero-click Android telephony DoS (researcher write-up)",
      "url": "https://smsofdeath.com/",
      "publisher": "Mark B",
      "date": "2026-10-29"
    },
    {
      "kind": "advisory",
      "title": "MarkBlah/smsofdeath: WAP Push remote modem crash PoC",
      "url": "https://github.com/MarkBlah/smsofdeath/",
      "publisher": "GitHub",
      "date": "2026-10-29"
    },
    {
      "kind": "news",
      "title": "New Android SMS of Death exploit can remotely crash unpatched phones",
      "url": "https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/",
      "publisher": "BleepingComputer",
      "date": "2026-10-31"
    }
  ],
  "tweets": [],
  "agentNotes": "On Android, open Settings > Security (or About phone) and check that the security patch level is October 2026 or later; install pending system updates and restart. Phones stuck on Android 12 or 13 get no fix from Google, so check whether the maker ships its own patch. If a phone is crash-looping, the researcher's repo describes clearing the queued messages with ADB.",
  "updatedAt": "2026-11-01T00:14:43Z",
  "xPost": {
    "id": "2116688169437725166",
    "postedAt": "2026-11-01T00:26:00.771Z",
    "url": "https://x.com/pwnwatch_app/status/2116688169437725166"
  },
  "url": "https://pwn.watch/i/android-sms-of-death-wap-push-dos-cve-2026-58882",
  "json": "https://pwn.watch/i/android-sms-of-death-wap-push-dos-cve-2026-58882.json",
  "sections": [],
  "agentBrief": "# Security brief: Android \"SMS of Death\": one silent text crashes the phone service and drops calls (CVE-2026-58882)\n\nSource: https://pwn.watch/i/android-sms-of-death-wap-push-dos-cve-2026-58882 · status: live · severity: high · updated Nov 1, 2026, 00:14 UTC\n\n## Patch status\n**PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.**\n\n## What it is\nA researcher published a working proof-of-concept for CVE-2026-58882, nicknamed \"SMS of Death\", a zero-click denial-of-service flaw in Android's telephony framework. Android's WapPushOverSms.decodeWapPdu() reads a WAP Push header length and casts it to a signed 32-bit integer with no range check, so an 8-byte data SMS sent to port 2948 makes it allocate an array of size -2147483648, which throws an uncaught NegativeArraySizeException and kills com.android.phone. That drops cellular service and any active call, including emergency calls, and the message never shows up in the inbox. The researcher reports that about 20 messages can leave a phone unusable, that carrier redelivery and retries on boot keep re-crashing it, and that one Android 12 test phone fell into a recovery-mode reboot loop that needed a factory reset; clearing the queued messages otherwise takes ADB. Google's fix (\"Fix remote DoS in decodeWapPdu\") shipped in the October 2026 Android security update for Android 14 through 17. It catches the exception and deletes the poison message rather than adding a bounds check. Android 12 and 13 run the same code and get no fix. The flaw is not listed in Google's October bulletin, and exploitation in the wild has not been reported.\n\nSeverity detail: Zero-click remote crash of the phone service that drops active calls, including emergency calls; public PoC, and Android 12 and 13 get no fix\n\n- Product: Android telephony framework (com.android.phone)\n- CVE / advisory ids: CVE-2026-58882\n\n## Affected versions\n- Android 12 through 17 before the October 2026 security update (crash reproduced on Android 12 through 16)\n- Android 12 and 13 (no fix released)\n\n## Check whether you're affected\nNo generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.\n\n## Fix\nUpgrade to one of these fixed versions (or later on the same branch):\n- Android 14, 15, 16 and 17 with the October 2026 security update (AOSP commit 735d967, \"Fix remote DoS in decodeWapPdu\")\n\nAfter upgrading, re-run the checks above and redeploy/restart the affected services.\n\n## Mitigations\nThe data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows).\n\n## Specific notes\nOn Android, open Settings > Security (or About phone) and check that the security patch level is October 2026 or later; install pending system updates and restart. Phones stuck on Android 12 or 13 get no fix from Google, so check whether the maker ships its own patch. If a phone is crash-looping, the researcher's repo describes clearing the queued messages with ADB.\n\n## Latest updates\n- Oct 31, 2026: BleepingComputer reports the public exploit and notes the flaw is not listed in Google's October security bulletin.\n- Oct 29, 2026: The researcher publishes the technical write-up and a proof-of-concept sender app, noting that Android 12 and 13 stay unpatched.\n- Oct 2026: Google's fix, commit 735d967 \"Fix remote DoS in decodeWapPdu\", ships in the October 2026 Android security release for Android 14 through 17; it catches the exception and deletes the poison message.\n- May 5, 2026: Researcher Mark B reports the WAP Push crash to Google's Android and Devices VRP.\n\n## Advisories\n- [SMS of Death: zero-click Android telephony DoS (researcher write-up)](https://smsofdeath.com/) (Mark B)\n- [MarkBlah/smsofdeath: WAP Push remote modem crash PoC](https://github.com/MarkBlah/smsofdeath/) (GitHub)\n\n## Write-ups & news\n- [New Android SMS of Death exploit can remotely crash unpatched phones](https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/)\n\n---\nMachine-readable: https://pwn.watch/i/android-sms-of-death-wap-push-dos-cve-2026-58882.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems."
}