Android SMS of Death Vulnerability Remotely Crashes Phones Silently

A zero-click denial-of-service flaw in Android’s SMS processing lets attackers remotely crash phones and sever cellular service by sending specially crafted text messages. The vulnerability, dubbed “SMS of Death” (CVE-2026-58882), exploits improper validation in the WapPushOverSms.decodeWapPdu function where a malformed WAP Push message causes a header-length value to become a negative 32-bit integer. This triggers a NegativeArraySizeException that crashes the com.android.phone process—which controls all cellular functions. Android processes the message before it reaches the inbox, leaving victims with no warning of what disrupted their device, including potential interruptions to emergency calls.

Multiple messages amplify the damage; testing revealed 20 malicious texts could trap phones in continuous reboot cycles, with some devices rebooting every 90 seconds until requiring a factory reset. Researcher Mark Blah published working proof-of-concept code and detailed technical analysis. Removing the malicious messages without professional help demands Android Debug Bridge access and technical expertise.

Google patched the flaw in its October 2026 update for Android 14 through 17 but left Android 12 and 13 unprotected and omitted it from the official security bulletin. The fix handles exceptions and deletes malicious messages from the SMS database to stop repeated crashes. Now that public exploits are available, supported Android users should install the latest patches immediately, though actual rollout hinges on manufacturer and carrier deployment decisions.