A newly disclosed Android vulnerability allows attackers to remotely crash smartphones by sending a specially crafted text message that users do not need to open or even see.
The flaw, tracked as CVE-2026-58882 and nicknamed “SMS of Death”, can disrupt mobile connectivity and disconnect ongoing calls, including emergency calls. Security researcher Mark Blah has released a working proof-of-concept, making the vulnerability a concern for devices that have not received the relevant security fix.
The attack requires no action from the recipient. The malicious message is processed by Android before it appears in the ordinary SMS inbox, leaving users without a visible warning.
Invisible Message Can Crash Android’s Calling System
The vulnerability affects Android’s handling of WAP Push messages, a legacy messaging mechanism that allows mobile networks to deliver certain types of information directly to devices without requiring users to open a conventional text message.
The problem lies in a component called WapPushOverSms, which processes these incoming messages. According to the researcher’s technical analysis, Android failed to properly validate a value describing the length of a message header.
A specially malformed message can cause this value to be interpreted as a negative number. When the operating system attempts to allocate memory using that value, an error crashes the com.android.phone process, which handles important cellular functions.
As a result, the phone can temporarily lose mobile connectivity and terminate active calls. The recipient does not have to click a link, download an application or grant any permission for the attack to work.
Repeated Messages Can Trigger Reboot Loops
The impact can become more serious when attackers send multiple malicious messages.
Blah reported that around 20 messages could leave a vulnerable device stuck in a repeated crash or reboot cycle. During testing on an Android 12 device, the phone repeatedly entered recovery mode at intervals of approximately 90 seconds.
The problem can persist because Android or the mobile carrier may attempt to process or deliver the malicious messages again. This can trigger another crash even after the device restarts.
A GitHub contributor identified a recovery method involving Android Debug Bridge (ADB), which allows a computer to communicate with an Android device. However, it requires technical knowledge and access to a computer, making recovery difficult for ordinary users.
The vulnerability is classified as a denial-of-service flaw. It does not, by itself, give an attacker access to photographs, passwords, banking applications or other private information. Its primary impact is the ability to disrupt the phone’s essential communication functions.
Google Developed A Fix Before Public Disclosure
The researcher said he first reported the vulnerability to Google on May 5, 2026. According to Android’s public code records, a fix was developed on June 15.
The change, titled “Fix remote DoS in decodeWapPdu”, instructs Android to handle unexpected errors during WAP Push message processing and remove problematic messages from its internal database. This prevents the same malformed message from repeatedly crashing the phone.
Blah says the fix was included in October 2026 security updates for Android 14 through Android 17. However, the vulnerability is not separately listed in Google’s October Android Security Bulletin.
The researcher has warned that Android 12 and 13 devices remain exposed because they did not receive the same fix. The exact protection available on individual phones depends on their software version, manufacturer and security update status.
Android Authority also reported that the researcher had earlier faced difficulty getting Google to recognise the issue as a security vulnerability, despite the company having developed a technical fix. Google had not publicly explained the apparent discrepancy at the time of reporting.
Public Proof-Of-Concept Raises The Risk
The disclosure has become more significant because a working proof-of-concept is now publicly available.
The demonstration can send the specially crafted message from another Android device to a target handset. Its release means security researchers and device manufacturers can reproduce the problem, but it also gives potential attackers a practical demonstration of how the flaw works.
The researcher has described the release as intended for security research and defensive testing. The demonstration should not be used against devices without explicit authorisation.
What This Means For Android Users
Android users should check whether their phones have received the latest available security updates. The device’s security patch level can usually be found under Settings, in the About phone or Software information section, although the exact menu differs between manufacturers.
Users should install pending system updates and restart their devices if required. Those using older phones that no longer receive security updates should check with the manufacturer whether a relevant fix is available.
The incident also shows why a suspicious message is not always something users can identify and avoid by simply refusing to click a link. Some operating-system vulnerabilities are triggered while a device processes incoming data automatically.
For affected users, the most important protection is a patched device. The absence of a suspicious message in the inbox does not mean that a vulnerable phone cannot be targeted.
