cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Android “SMS of Death” Flaw Can Crash Phones With Malformed Texts

· Original article ↗

Summary

A proof-of-concept targets CVE-2026-58882, a zero-click Android WAP Push flaw that can crash cellular services or trigger reboot loops. Google reportedly patched Android 14–17 in October; Android 12–13 remain vulnerable.

Key points

  • The zero-click flaw is triggered by a specially crafted eight-byte WAP Push data SMS sent to port 2948.
  • Improper validation in Android’s WapPushOverSms.decodeWapPdu function can turn a header-length value into a negative integer, causing a NegativeArraySizeException and crashing com.android.phone.
  • The crash can disrupt cellular service and disconnect ongoing calls, including emergency calls.
  • The researcher reports that repeated malicious messages can cause reboot loops; one tested Android 12 device entered recovery mode about every 90 seconds and required a factory reset.
  • An Android Debug Bridge method can remove malicious messages, but requires a computer and more technical knowledge.
  • Google reportedly patched Android 14–17 in its October 2026 updates; Android 12 and 13 reportedly did not receive the fix. The patch catches processing exceptions and deletes malicious messages from the SMS database.
  • The article advises installing the latest security updates; update availability depends on the device manufacturer and carrier, and a restart may be needed.

Article Details

Vulnerability Types
  • Improper validation of a WAP Push header-length value
Affected Versions
  • Android 12
  • Android 13
  • Android 14
  • Android 15
  • Android 16
  • Android 17
Exploitation Status
unknown
Exploit Availability
public_poc
Patch Status
partial
Workarounds
  • Install the latest security updates on supported devices.
  • Use Android Debug Bridge (ADB) to remove the malicious messages; the article says this requires a computer and more advanced technical knowledge.

MITRE ATT&CK

T1499.004 · Application or System ExploitationA crafted WAP Push message exploits the Android flaw to crash the com.android.phone process and disrupt cellular service.

CVE

CVE-2026-58882exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted

People

Mark BlahThe vulnerability researcher who published the technical analysis and proof-of-concept exploit.SakisA GitHub contributor credited with finding a way to remove the malicious messages using Android Debug Bridge.

Vendors

GoogleAccording to the vulnerability researcher, Mark Blah, Google reportedly patched the vulnerability in its October 2026 Android security updates for Android 14 through 17.

Products

AndroidNew Android SMS of Death exploit can remotely crash unpatched phones

Tools

Android Debug BridgeA GitHub contributor named Sakis discovered a way to remove the malicious messages using Android Debug Bridge (ADB), but the process requires more advanced technical knowledge and access to a computer.

Related Articles