Security researcher Mark Blah has released a proof-of-concept exploit for an Android flaw that can crash a phone’s cellular process and disconnect calls, including emergency calls, BleepingComputer reported on October 31. Dubbed “SMS of Death” and tracked as CVE-2026-58882, the vulnerability requires no interaction from the recipient: a specially crafted text message triggers it before reaching the SMS inbox.
Blah says Google fixed the flaw for Android 14 through 17 in its October 2026 security updates, although the identifier does not appear in Google’s October security bulletin, the BleepingComputer report noted. Android 12 and 13 devices remain vulnerable because they did not receive the fix, the researcher said.
The practical consequence extends beyond a single dropped call. Malicious messages can cause repeated crashes, and Blah’s testing showed that a sequence of messages could leave phones stuck in reboot loops.
How a text message disrupts cellular service
The vulnerability sits in WapPushOverSms.decodeWapPdu, an Android function that processes WAP Push messages delivered over SMS. It fails to properly validate a header-length value before using it to allocate memory.
The exploit sends this malformed eight-byte message as a data SMS addressed to port 2948:
01 06 88 80 80 80 00 BE
During processing, the header-length value becomes -2147483648 when converted to a signed 32-bit integer without a bounds check. Android then attempts to allocate memory using that negative value, triggering a NegativeArraySizeException that crashes com.android.phone, the process responsible for cellular functions.
That crash interrupts mobile connectivity and ongoing calls. Because processing happens before the message reaches the inbox, the recipient has no visible message explaining what caused the disruption.
Blah said crashes can recur when a carrier attempts to deliver the malicious message again or when Android processes malicious messages already stored on the device. In testing, sending 20 malicious messages could cause reboot loops. One Android 12 device rebooted into recovery mode approximately every 90 seconds and required a factory reset to recover.
The published proof of concept can send the malicious messages from another Android device.
Updates and recovery
Google’s patch, titled “Fix remote DoS in decodeWapPdu,” catches exceptions raised while Android processes malformed messages, the report said. DoS means denial of service: disrupting a system’s availability. The patch also deletes malicious messages from the SMS database so they cannot repeatedly trigger crashes.
A GitHub contributor named Sakis found a way to remove the messages using Android Debug Bridge, or ADB, a tool for communicating with an Android device from a computer. That recovery method requires computer access and more advanced technical knowledge.
With a working exploit now public, Android users should install the latest available security updates, as BleepingComputer recommends. Supported devices generally install security updates automatically, but availability depends on the manufacturer and carrier, and a restart may be needed to finish installation.
