Android vulnerability dubbed SMS of Death can crash devices

CVE-2026-58882 Android vulnerability SMS of Death WAP Push zero-click exploit

Security researcher Mark Blaszczyk has identified a critical zero-click vulnerability in the Android operating system, tracked as CVE-2026-58882. Dubbed the “SMS of Death,” the flaw allows attackers to remotely disrupt cellular connectivity or crash devices by sending a specially crafted WAP Push SMS message.

The vulnerability is triggered during the background processing of the message, meaning it can affect a device before the user even sees the text in their inbox. This requires no user interaction, such as clicking a link or opening an attachment. The exploit targets a memory management error in the WapPushOverSms.decodeWapPdu function, where an improper header-length validation causes a NegativeArraySizeException, crashing the com.android.phone process.

Consequences of the attack include interrupted phone calls, including emergency services, and loss of mobile network connectivity. In severe cases, repeated messages can trap a device in a reboot loop, with some tests showing phones restarting approximately every 90 seconds. Some devices may become nearly unusable until a factory reset is performed.

Google released security patches for Android versions 14 through 17 in October 2026. However, devices running Android 12 and 13 may remain vulnerable as they fall outside the standard update window for this specific fix. The vulnerability has been confirmed on various hardware, including Google Pixel and Samsung Galaxy models.

Entities

Android · Google · Google Pixel · Google Pixel · Mark Blaszczyk · Samsung

Claims

What the coverage asserts, and how many sources carry each claim.

[● 13 SOURCES] A security vulnerability identified as CVE-2026-58882 exists in the Android operating system. havadis.at · lomazoma.com · www.chip.de · www.dday.it · trn.mk · +8 more
[● 13 SOURCES] The attack requires no user interaction to succeed. havadis.at · www.chip.de · www.dday.it · trn.mk · lomazoma.com · +8 more
[● 13 SOURCES] The vulnerability is triggered by a specially crafted WAP-Push SMS message. havadis.at · www.chip.de · www.dday.it · trn.mk · lomazoma.com · +8 more
[● 10 SOURCES] The flaw can interrupt active phone calls, including emergency calls. havadis.at · www.chip.de · www.dday.it · trn.mk · www.chiccheinformatiche.com · +5 more
[● 3 SOURCES] The vulnerability can cause phones to reboot approximately every 90 seconds. havadis.at · lomazoma.com · tbreak.com
[● 9 SOURCES] The vulnerability affects Android versions 12 through 17. havadis.at · lomazoma.com · www.dday.it · trn.mk · tbreak.com · +3 more
[● 5 SOURCES] The vulnerability does not allow for the theft of personal data like passwords or photos. www.dday.it · trn.mk · tbreak.com · novini247.com · clubz.bg
[● 9 SOURCES] Google released security updates for Android 14 through 17 in October. havadis.at · lomazoma.com · www.dday.it · trn.mk · www.chiccheinformatiche.com · +4 more