Proof-of-concept exploit released for Android ‘SMS of Death’ flaw

Vulnerability researcher Mark Blah has released a technical analysis and proof-of-concept exploit for CVE-2026-58882, a zero-click denial-of-service flaw in Android dubbed "SMS of Death". The vulnerability allows attackers to remotely crash phones and disrupt cellular service by sending a malformed eight-byte WAP Push message over SMS, which Google reportedly patched in its October 2026 security updates for Android 14 through 17.

The flaw stems from improper validation of a header-length value in the WapPushOverSms.decodeWapPdu function. When translated into a signed 32-bit integer without a bounds check, the value becomes -2147483648. Attempting to allocate memory with this negative value triggers a NegativeArraySizeException that goes uncaught in InboundSmsHandler and kills the com.android.phone process within one to two seconds. Because this process manages cellular functions, the crash causes a brief loss of signal and drops active calls, including emergency calls, without any interaction from the victim. Android processes the message before it reaches the SMS inbox, leaving no visible indication of what caused the crash.

Blah's proof-of-concept Android app sends the crafted message from another Android handset using the SEND_SMS, READ_PHONE_NUMBERS, and READ_PHONE_STATE permissions. Repeated crashes can also occur when carriers attempt to redeliver the malicious messages or when Android tries to process messages already stored on the phone. In testing, sending 20 malicious messages caused phones to get stuck in reboot loops; one Android 12 device rebooted into recovery mode approximately every 90 seconds, requiring a factory reset to recover.

Google's patch, titled "Fix remote DoS in decodeWapPdu", prevents the crashes by catching exceptions triggered when processing the malformed text messages and deleting them from the SMS database. However, the flaw is not listed in Google's October security bulletin, and older Android 12 and 13 devices remain vulnerable because they did not receive the fix.

A GitHub contributor named Sakis discovered a way to remove the malicious messages using Android Debug Bridge (ADB), though the process requires advanced technical knowledge and access to a computer. On supported devices, security updates are generally installed automatically depending on the device manufacturer and carrier, and Android users are advised to install the latest updates and restart their phones to complete installation.

Sources: BleepingComputer, GitHub

Written with AI and fact-checked against the linked sources by an automated AI review before publication. Spotted an error? See our Corrections Policy.