Android SMS of Death PoC can crash unpatched phones (CVE-2026-58882)
Original title: New Android SMS of Death exploit can remotely crash unpatched phones
A public proof of concept sends a malformed WAP Push that crashes com.android.phone and can drop emergency calls.
Researcher Mark Blah released a proof-of-concept for CVE-2026-58882, a zero-click denial-of-service flaw in Android's WapPushOverSms.decodeWapPdu function. A crafted data SMS to port 2948 is processed before the inbox and can crash the phone process, interrupting calls including emergency calls. Blah says Google patched Android 14 through 17 in October 2026 updates, but Android 12 and 13 did not receive the fix. The flaw is not listed in Google's October bulletin.
Unconfirmed: The October patch is reported by the researcher and is not listed in Google's October security bulletin.
- An eight-byte WAP Push becomes a negative length and throws NegativeArraySizeException.
- Sending 20 messages put one Android 12 phone into a reboot loop about every 90 seconds.
- Recovery on that device required a factory reset; ADB can delete stored messages.
- Google's fix catches the exception and deletes malicious messages from the SMS database.
Impact: Remote zero-click crash that drops cellular calls
| Product | Affected | Fixed in |
|---|---|---|
| Google Android | Android 12 and 13 remain vulnerable; Android 14 through 17 were affected before the October 2026 updates | October 2026 Android security updates |
- 1.Install the latest Android security updates and restart if required.
- 2.Treat Android 12 and 13 devices as still vulnerable to the WAP Push crash.
- CVEs
- CVE-2026-58882
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58882 | — | — | — |
From the original article
2 min read at bleepingcomputer.com.jpg&w=1280&q=75)
A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.