New Android SMS of Death exploit can remotely crash unpatched phones

What it is

CVE-2026-58882 ("SMS of Death") is a zero-click Android denial of service in WapPushOverSms.decodeWapPdu, published with a public proof-of-concept by researcher Mark Blah. The page adds details on persistence, recovery and patch coverage that the catalog summary leaves out.

How it works

Android processes the malformed WAP Push message before it reaches the SMS inbox, so the victim sees no message and no sign of the cause. The unchecked header-length value becomes -2147483648 as a signed 32-bit integer. The allocation then throws a NegativeArraySizeException and crashes com.android.phone, which manages cellular functions.

The crash can repeat. Carriers may redeliver the message, and Android may reprocess messages already stored on the phone. Mark Blah found that 20 messages could cause a reboot loop. On one Android 12 device, the phone rebooted into recovery mode about every 90 seconds, and only a factory reset recovered it. The published PoC sends the messages from another Android device.

Preconditions / Affected

• Android 12 and 13 devices are still vulnerable because they did not receive the fix.
• Android 14 through 17 were reportedly patched in the October 2026 updates.
• The flaw is not listed in Google's October security bulletin, so a bulletin search will not find it. Check patch level directly.
• The attacker needs only to be able to send a data SMS to the target's number.

What to do

• Install the latest Android security update and restart if the installer asks, since a restart may be needed to finish installation. Availability depends on the device maker and carrier.
• Google's fix, "Fix remote DoS in decodeWapPdu", catches the exceptions raised by malformed messages. It also deletes the malicious messages from the SMS database, which stops repeat crashes.
• On an already affected phone, a GitHub contributor named Sakis found a way to remove the malicious messages with Android Debug Bridge (ADB). It needs a computer and more technical skill. The page does not give the commands.

Caveats

• Android 12 and 13 have no patch mentioned, so the page offers those users no fix.
• The patch status for Android 14 through 17 comes from the researcher's report ("reportedly"), not from Google's bulletin.
• The page does not say how many devices are exposed or whether the flaw has been exploited in the wild.