#Zero-click

Android "SMS of Death": one silent text crashes the phone service and drops calls (CVE-2026-58882)

A researcher published a working proof-of-concept for CVE-2026-58882, nicknamed "SMS of Death", a zero-click denial-of-service flaw in Android's telephony framework. Android's WapPushOverSms.decodeWapPdu() reads a WAP Push header length and casts it to a signed 32-bit integer with no range check, so an 8-byte data SMS sent to port 2948 makes it allocate an array of size -2147483648, which throws an uncaught NegativeArraySizeException and kills com.android.phone. That drops cellular service and any active call, including emergency calls, and the message never shows up in the inbox. The researcher reports that about 20 messages can leave a phone unusable, that carrier redelivery and retries on boot keep re-crashing it, and that one Android 12 test phone fell into a recovery-mode reboot loop that needed a factory reset; clearing the queued messages otherwise takes ADB. Google's fix ("Fix remote DoS in decodeWapPdu") shipped in the October 2026 Android security update for Android 14 through 17. It catches the exception and deletes the poison message rather than adding a bounds check. Android 12 and 13 run the same code and get no fix. The flaw is not listed in Google's October bulletin, and exploitation in the wild has not been reported.

Android telephony framework (com.android.phone)·Since Oct 29, 2026·updated Nov 7, 2026, 11:52 UTC