New Android SMS of Death Exploit Remotely Crashes Phones
A newly released proof-of-concept exploit allows attackers to remotely disrupt cellular service and crash unpatched Android devices by sending a specially crafted text message.
Radwan AbdulhadiEditor and technology writer
Overview of the SMS of Death Flaw
A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability dubbed the "SMS of Death" and tracked as CVE-2026-58882. This zero-click denial-of-service flaw lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message.
The vulnerability can interrupt ongoing phone calls, including emergency calls, without requiring any user interaction. Because Android processes the incoming message before it even reaches the standard SMS inbox, victims have no visible indication of what caused their mobile devices to crash.
Technical Mechanics and Vulnerability Analysis
According to vulnerability researcher Mark Blah, the flaw stems from improper validation of a header-length value within Android's WapPushOverSms.decodeWapPdu function. A technical analysis details how an attacker can send a malformed eight-byte WAP Push message to targeted mobile phones.
When the header-length value is translated into a signed 32-bit integer without a proper bounds check, it evaluates to -2147483648. When Android attempts to allocate memory using this negative value, it triggers a NegativeArraySizeException that crashes the com.android.phone process.
Because the com.android.phone process is responsible for managing cellular functions, the crash immediately disrupts mobile connectivity and disconnects ongoing phone calls, including emergency services.
Severe Consequences and Reboot Loops
The researcher noted that the attack can trigger repeated crashes when cellular carriers attempt to redeliver malicious messages or when Android tries to process messages already stored on the device. During testing, sending 20 malicious messages caused phones to become trapped in persistent reboot loops.
On one tested Android 12 device, the smartphone rebooted into recovery mode roughly every 90 seconds, forcing the user to perform a factory reset to regain control of the device. Although a GitHub contributor named Sakis discovered a method to remove the malicious messages using the Android Debug Bridge (ADB), this workaround requires advanced technical knowledge and access to a computer.
Proof-of-Concept and Available Mitigations
The researcher has published a proof-of-concept exploit capable of transmitting the malicious messages from another Android device. To address the issue, Google implemented a fix titled "Fix remote DoS in decodeWapPdu," which prevents crashes by catching exceptions triggered during the processing of malformed text messages.
The official patch also removes malicious messages from the underlying SMS database to prevent them from inducing repeated crashes. According to Mark Blah, Google patched the vulnerability for Android versions 14 through 17 as part of the October 2026 Android security updates.
However, the vulnerability is omitted from Google's October security bulletin, and older Android 12 and 13 devices remain exposed because they did not receive the official patch.
Recommendations for Android Users
While Android security updates generally install automatically on supported hardware, availability varies depending on the device manufacturer and cellular carrier. A device restart may also be necessary to complete the installation process.
Following the public release of a working proof-of-concept exploit, security experts strongly advise all Android users to check for and install the latest available security updates to safeguard their devices against potential disruption.
Sources
- BleepingComputerNew Android SMS of Death exploit can remotely crash unpatched phones
Continue chronologically
Related entity coverage
Related stories
Android November 2026 Updates Patch Over 200 Vulnerabilities
Google has announced its November 2026 security updates for Android, addressing over 200 vulnerabilities, including a critical remote code execution flaw.
Google Releases October 2026 Android Updates Patching 25 Vulnerabilities
Google has rolled out its October 2026 Android security updates, patching 25 vulnerabilities across Framework and System components, including critical bugs.
How to Check If Your Android Phone Still Gets Security Updates
Learn how to check your Android phone's security update status, find manufacturer end-of-life dates, and secure an unsupported device.
Google Messages Adds Enhanced Protection Mode for Android
Google is introducing an enhanced protection mode in Google Messages and new Android security features for Cybersecurity Awareness Month.
