Android SMS of Death Exploit Goes Public, Leaving Android 12 and 13 Phones Without a Fix

A security researcher has published a working exploit for an Android flaw dubbed “SMS of Death” that can crash phones and cut cellular service with a single crafted text message.

Google fixed the bug, tracked as CVE-2026-58882, in the October 2026 Android security updates for Android 14 through 17, according to researcher Mark Blah, while Android 12 and 13 devices did not receive the fix.

The attack is zero-click. Android processes the malicious message before it reaches the SMS inbox, so the target sees nothing that explains the crash. Blah notes that the flaw is not listed in Google’s October security bulletin, even though the fix appears in Android’s telephony code.

How the Android SMS of Death Attack Works

Blah traced the flaw to improper validation of a header-length value in Android’s WapPushOverSms.decodeWapPdu function. An attacker sends a malformed eight-byte WAP Push message as a data SMS to port 2948. Without a bounds check, the length value turns into -2147483648 when read as a signed 32-bit integer.

Android then tries to allocate memory with that negative size, which throws a NegativeArraySizeException and crashes the com.android.phone process. Because that process manages cellular functions, the crash disrupts mobile connectivity and drops calls in progress, including calls to emergency services.

The damage can repeat. Carriers may try to redeliver the message, and Android may process messages already stored on the phone again. In Blah’s testing, 20 malicious messages pushed phones into reboot loops. One Android 12 device restarted into recovery mode roughly every 90 seconds, and only a factory reset recovered it.

A GitHub contributor named Sakis found a way to remove the messages with Android Debug Bridge (ADB), but the method requires a computer and technical knowledge.

Blah has also released a proof-of-concept exploit that sends the malicious messages from another Android device, so the attack no longer requires custom tooling.

What Android Users Should Check Now

Google’s fix, titled “Fix remote DoS in decodeWapPdu,” catches the exceptions caused by the malformed messages and deletes those messages from the SMS database so they cannot trigger repeated crashes. Android owners can take these steps:

1. Check the phone for a pending system or security update and install it.
2. Restart the device if prompted, since installation may require a reboot to complete.
3. Confirm that the phone runs Android 14 or later with the October 2026 security update or newer.

Security updates install automatically on supported devices, but availability depends on the phone maker and the carrier, so the timing of the October patch varies from one Android 14 to 17 phone to the next.

Owners of Android 12 and Android 13 phones have no patch to install. The October bulletin does not list CVE-2026-58882, and no fix for those two versions has been released.

Thank you for being a Ghacks reader. The post Android SMS of Death Exploit Goes Public, Leaving Android 12 and 13 Phones Without a Fix appeared first on gHacks.