Researcher publishes Android 'SMS of Death' exploit after October patch

A security researcher has released a proof-of-concept exploit for an Android denial-of-service flaw tracked as CVE-2026-58882 and dubbed "SMS of Death," according to BleepingComputer. The researcher, Mark Blah, also published a technical analysis of the vulnerability.

The flaw is a zero-click issue: a malformed eight-byte WAP Push message sent as a data SMS to port 2948 is enough to crash the com.android.phone process. That disrupts mobile connectivity and disconnects ongoing calls, including emergency calls. The root cause is improper validation of a header-length value in Android's WapPushOverSms.decodeWapPdu function.

Repeated abuse makes the impact worse. Sending 20 malicious messages can put a phone into a reboot loop; one Android 12 device rebooted into recovery mode roughly every 90 seconds.

Patch status and workaround

Google's fix, titled "Fix remote DoS in decodeWapPdu," catches the exceptions and deletes the malicious messages from the SMS database. The flaw is patched in the October 2026 Android security updates for Android 14 through 17, though it is not listed in Google's October security bulletin.

Android 12 and Android 13 devices did not receive the fix and remain vulnerable. A GitHub contributor named Sakis found a way to remove the malicious messages using Android Debug Bridge (ADB).