Public Exploit Released for Android "SMS of Death" Flaw That Crashes Unpatched Phones
CVE-2026-58882 was fixed for Android 14 through 17 in October, but Android 12 and 13 devices remain exposed to a text message that can crash the phone process.
A researcher has published a proof-of-concept exploit for CVE-2026-58882, an Android denial-of-service flaw nicknamed "SMS of Death," BleepingComputer reported on October 31. The bug can disrupt cellular service or crash a phone with a specially crafted text message, with no action from the recipient.
How the flaw works
According to the report, the researcher, Mark Blah, posted a technical analysis and working exploit on GitHub. The problem lies in how Android validates a header-length value in the `WapPushOverSms.decodeWapPdu` function. Without a bounds check, the value converts to a negative number, memory allocation fails with an exception, and the `com.android.phone` process crashes.
The trigger is an eight-byte malformed WAP Push message sent as a data SMS. Android handles it before it reaches the inbox, so victims see no sign of the cause. The exploit can send the messages from another Android device.
Impact
- The crash can interrupt ongoing calls, including emergency calls.
- Sending 20 malicious messages could put phones into reboot loops.
- On one Android 12 test device, the phone rebooted into recovery mode about every 90 seconds, and a factory reset was needed.
- Repeated crashes can recur when carriers redeliver the message or Android reprocesses stored ones.
Patch status
Google reportedly fixed the flaw in its October 2026 Android security updates for Android 14 through 17, with a change titled "Fix remote DoS in decodeWapPdu" that catches the exception and deletes the offending messages. BleepingComputer noted the flaw does not appear in Google's October security bulletin and did not include a Google statement.
Android 12 and 13 did not receive the fix and remain vulnerable. A GitHub contributor found a way to remove the malicious messages with Android Debug Bridge, though it requires a computer and technical skill. Update timing depends on device makers and carriers, and a restart may be needed to finish installation. Users are advised to install the latest security update now that a public exploit exists.
