Exploit released for Android 'SMS of Death' bug that knocks phones off the network
A security researcher has published a working exploit for an Android bug that lets anyone who knows your phone number knock the phone off the cellular network with a single hidden text message. The flaw, which the researcher calls "SMS of Death" and BleepingComputer tracks as CVE-2026-58882, crashes the system process that handles calls and mobile data, and it can cut off a call to emergency services while it is in progress. Google fixed it in the October 2026 Android security update for Android 14 through 17. Phones on Android 12 and 13 do not get that fix, BleepingComputer reported on 31 October.
How one message takes a phone offline
The attack uses WAP Push, an old SMS format that operators use to send settings and service messages to phones. According to the technical write-up by researcher Mark B, Android reads a length value from the message header and turns it into a negative number without checking it. When the system then tries to reserve memory of that size, the com.android.phone process crashes. That process runs calls, SMS and mobile data, so the phone loses signal for a second or two and any active call drops.
The victim does not have to tap or open anything. The message arrives as a data SMS, never appears in the messaging app, and the sender's number is not shown. The researcher says the crash was reproduced on Android versions from 12 to 16, with a 100% success rate on a Pixel 9 running April 2026 firmware and on several Samsung Galaxy models.
Why a single text can cause a reboot loop
If the phone does not confirm delivery, the operator sends the message again, and the phone crashes again. The message also stays in the phone's queue of incoming SMS and is processed on every boot. In testing, one message caused intermittent outages for up to a week. About 20 of them made a device unusable for an extended period. An Android 12 phone kept restarting into recovery mode roughly every 90 seconds, where Android offers to wipe all data.
A GitHub user found a way out of the loop without a factory reset: deleting the malicious messages over ADB, Android's debugging tool, in the short window after each boot. It needs a computer, USB debugging already switched on in the phone's settings and some technical skill, so for most people a phone stuck in this state would end up wiped.
A quiet fix that skips older phones
The researcher says the bug was reported to Google on 5 May 2026. A fix titled "Fix remote DoS in decodeWapPdu" was committed in June and shipped in the October 2026 Android security update for Android 14 through 17. It does not add the bounds check the researcher proposed. Instead it catches the crash and deletes the triggering message so it cannot fire again on the next boot. The bug is not listed in Google's October security bulletin. Android 12 and 13 run the same code but are outside the update window.
The proof-of-concept app was published on GitHub on 29 October. It sends the message from one Android phone to another, so the attack now needs no special equipment.
How to check your phone
Open your phone's settings and find the security update date. On Pixel phones it is under Settings, About phone, Android version, "Android security update". On Samsung phones it is under Settings, About phone, Software information, "Android security patch level". A date of 1 October 2026 or later means the fix is in place, provided the phone runs Android 14 or newer. If an update is waiting, install it and restart the phone. The release of updates depends on the manufacturer and the carrier, so some Android 14 to 17 phones may get it later than Pixels.
If your phone is on Android 12 or 13, no official fix is coming. A VPN does not help here: the attack arrives over the cellular network, not the internet. For anyone who relies on such a phone for emergency calls, the only real protection is a newer device that still receives updates.
