Overview
- Security researcher Mark Blaszczyk disclosed a zero‑click vulnerability that uses a single hidden WAP‑Push SMS to crash the Android telephony service and force repeated restarts.
- The fault is caused by an unchecked typecast: a manipulated WSP length becomes a negative array size and throws a NegativeArraySizeException in com.android.phone.
- Google assigned the bug CVE‑2026‑58882 and pushed fixes for Android 14–17 into AOSP in October, but many non‑Pixel phones still await manufacturer rollouts and Android 12–13 devices are likely unpatched.
- Users whose phones show the recovery prompt are warned not to choose “Wipe data” because that erases everything; experts recommend connecting the phone to a PC and using ADB or seeking professional help to preserve data.
- Carrier behavior and automatic re‑delivery of unconfirmed WAP‑Push messages can keep devices unusable for days, increasing the real‑world impact on calls and everyday phone use.