# Messaging app and mobile security vulnerabilities > Developing situation record from CLSTR: https://clstr.news/situations/messaging-app-and-mobile-security-vulnerabilities > Updated: 2026-11-01T07:33:01.000Z. Sources: 53. Developments: 3. Security researchers have identified several critical vulnerabilities across major messaging platforms and mobile operating systems. In the Signal messaging app, researchers found that macOS encryption keys were stored in plaintext alongside encrypted databases. This flaw, combined with unencrypted storage of attachments, could allow spyware to access sensitive data or clone installations without triggering warnings. Additionally, a vulnerability in Signal’s RingRTC calling library, designated CVE-2026-113380, could lead to a denial-of-service condition where audio or video channels remain active after a user attempts to end a call. Signal released version 2.72.0 to address the calling library issue. Regarding Android, a remote code execution vulnerability was discovered in the Telegram app. Attackers could execute arbitrary code by making a standard voice call that exploits how the app processes MediaState data. Telegram patched this in version 12.10.4. Furthermore, a zero-click denial of service vulnerability, referred to as the “SMS of Death,” was identified in the Android operating system. Tracked as CVE-2026-58882, the flaw allows attackers to disrupt mobile services by sending a specially crafted WAP Push message. Because the vulnerability resides in how the system processes message header lengths, the malicious message does not appear in the user's inbox and requires no interaction from the recipient. The exploit can cause the “com.android.phone” system process to crash, leading to dropped calls, including emergency services, or even a device bootloop. This issue has affected Google Pixel and various Samsung Galaxy devices. Google has released security updates for Android versions 14 through 17, but devices running Android 12 or 13 may remain vulnerable while awaiting manufacturer-specific patches. Security researcher Mark Blaszczyk noted that receiving approximately 20 such messages can render a device nearly unusable. ## Claims - The vulnerability affects Android versions 12 through 17. (reported by 23 sources) - The vulnerability affects Android versions 12 through 16. (reported by 3 sources) - Security researcher Mark Blaszczyk discovered the “SMS of Death” vulnerability. (reported by 31 sources) - The attack is a zero-click vulnerability requiring no user interaction. (reported by 20 sources) - The flaw can cause the telephony process (com.android.phone) to crash. (reported by 20 sources) - The attack uses a specially crafted WAP Push SMS. (reported by 19 sources) - The attack can interrupt emergency calls. (reported by 19 sources) - Google released a security update for Android 14 through 17 in October 2026. (reported by 15 sources) - The vulnerability was reproduced on Google Pixel and Samsung Galaxy devices. (reported by 15 sources) - A security vulnerability identified as CVE-2026-58882 exists in the Android operating system. (reported by 13 sources) ## Timeline ### 2026-11-01: Android vulnerability dubbed SMS of Death can crash devices A zero-click Android vulnerability, known as the “SMS of Death” (CVE-2026-58882), allows attackers to crash phones and disrupt emergency calls via malformed WAP Push messages. 13 sources. https://clstr.news/cluster/android-security-flaw-allows-remote-device-crashes-via-sms ### 2026-10-30: Android SMS of Death vulnerability allows remote device crashes A zero-click Android vulnerability known as “SMS of Death” allows attackers to crash phones and disrupt emergency calls using malformed WAP Push messages. Patches are available for Android 14 to 17. 41 sources. https://clstr.news/cluster/android-security-vulnerabilities-discovered-in-telegram-and-sms-processing ### 2026-10-21: Signal messaging app faces critical security vulnerabilities Signal faces critical security flaws, including plaintext encryption key storage on macOS and a vulnerability in its RingRTC library that can prevent calls from properly hanging up. 2 sources. https://clstr.news/cluster/signal-messaging-app-faces-critical-security-vulnerabilities --- Cite as: Messaging app and mobile security vulnerabilities. CLSTR, https://clstr.news/situations/messaging-app-and-mobile-security-vulnerabilities