Android 'SMS of Death' Zero-Click Flaw Crashes Unpatched Phones
A public proof-of-concept shows a malformed WAP‑Push SMS can drop calls or force reboots on devices that lack the October 2026 security update.
Overview
- Security researcher Mark Blah disclosed CVE-2026-58882 in late October 2026 and published a working proof-of-concept that sends a specially crafted WAP‑Push SMS to trigger the bug.
- The flaw is an improper header-length check in WapPushOverSms.decodeWapPdu that turns an eight-byte payload into a negative value and causes a NegativeArraySizeException that crashes com.android.phone.
- Google added a fix called “Fix remote DoS in decodeWapPdu” to the October 2026 Android security patches for Android 14–17, which catches the exception and deletes offending messages.
- Many devices remain exposed because Android 12 and 13 and phones waiting for OEM or carrier updates will not automatically receive the October patch, leaving users at risk of dropped calls, reboot loops, or factory reset.
- A technical workaround using ADB to remove malicious stored messages is available from a GitHub contributor but requires advanced steps, so users should check for and install vendor updates as soon as they arrive.