Android SMS of Death (CVE-2026-58882): Are You Safe?

Short answer: A researcher has published a working exploit for CVE-2026-58882, nicknamed "SMS of Death". A single malformed message can crash the phone's calling process without the owner touching anything. Google reportedly fixed it for Android 14 through 17 in October 2026, but Android 12 and 13 remain open. Install the latest security update now.

The key facts

One oddity: the article notes the flaw is not listed in Google's October security bulletin, so the fix is described as "reportedly" shipped. Treat the patch status as reported, not confirmed by Google.

What the bug does

The problem is in how Android reads WAP Push messages, a special kind of data text. The code reads a length value from the message and turns it into a signed 32-bit number without checking it. A crafted eight-byte message sent to port 2948 produces a negative size, the code throws a NegativeArraySizeException, and the com.android.phone process crashes.

Android handles the message before it reaches your inbox, so you see nothing. The crash can repeat if the carrier redelivers the message or the phone reprocesses stored ones. The researcher reports that:

• calls, including emergency calls, can be interrupted
• about 20 malicious messages can trap a phone in a reboot loop
• on one Android 12 device, the phone rebooted into recovery roughly every 90 seconds and needed a factory reset

The exploit can be sent from another Android device.

Step 1: find your Android version and patch level

Open Settings, then About phone, then Android version. Note the version and the "Android security update" date. Updates for 14 to 17 should show an October 2026 or later date.

Step 2: install the latest update

Go to Settings, System, Software update, and install anything pending. Updates depend on your phone maker and carrier, and a restart may be needed to finish. The fix, titled "Fix remote DoS in decodeWapPdu", catches the error and deletes the bad messages from the SMS database.

Step 3: handle Android 12 and 13

These versions did not get the fix. Check whether your manufacturer offers a later update. If not, avoid relying on the phone for emergencies, back up your data now, and plan a replacement. Do not leave an unsupported phone as your only way to call for help.

Step 4: if the phone is already looping

A GitHub contributor known as Sakis found a way to remove the bad messages using ADB (Android Debug Bridge, a developer tool) from a computer. It needs more technical skill, so a factory reset after backing up what you can may be simpler.

Common mistakes

• Assuming a text must be opened to be dangerous. This one is not.
• Updating only some devices in a family or office.
• Ignoring the update because the phone "seems fine". A crash needs only one message.
• Keeping an unsupported Android 12 or 13 phone for work or emergency use.