'SMS of Death': One hidden text can crash Android phones and drop emergency calls

The skim

• A researcher has published a working exploit for "SMS of Death" (CVE-2026-58882), an Android bug where one hidden text message crashes the phone's calling service and drops any active call, including calls to emergency services.
• About 20 of those messages can trap a phone in a reboot loop that ends at a "wipe data" prompt. The victim never sees the message.
• Google's fix shipped in the October 2026 security update for Android 14 through 17. Phones on Android 12 and 13 aren't getting it.

What happened

Security researcher Mark Blaszczyk published a writeup on Oct. 29 of what he describes as a remote, zero-click denial-of-service attack whose effects persist. The attack is a single malformed WAP Push message, a legacy kind of SMS that carriers use to send phones hidden instructions, such as MMS download prompts or carrier settings.

The trick is in a five-byte header field. Android reads a length value from it, converts it to a smaller number type without checking the range, and ends up with a negative value. Trying to create an array of negative size crashes com.android.phone, the system process that handles calls and cellular service. "The victim does nothing. No tap, no open, no notification," Blaszczyk writes. Nothing shows up in Messages, and the sender's number is never displayed.

Each message knocks out service for a second or two while the process restarts. It gets worse from there. Carriers re-send messages the phone never acknowledged, and Android retries the poisoned message on every boot. In his tests, one message caused on-and-off outages for up to a week, and about 20 made a phone unusable for an extended period. On one Android 12 device, Android's RescueParty recovery feature kicked the phone into recovery mode roughly every 90 seconds, BleepingComputer reports.

Blaszczyk says he reproduced it every time on a Pixel 9 running April 2026 firmware and on several Samsung Galaxy models, including A-series phones. His proof-of-concept app is public on GitHub.

The fix, and who's left out

Blaszczyk reported the bug to Google on May 5. A Google engineer committed a fix titled "Fix remote DoS in decodeWapPdu" on June 15. Rather than adding the bounds check Blaszczyk proposed, it catches the crash and deletes the malformed message so it can't keep re-triggering. It shipped in the October 2026 security release for Android 14 through 17, though it wasn't listed in Google's October bulletin. GrapheneOS says it will appear in the November bulletin, heise reports. Heise also reports that Google initially closed the bug report as "Will Not Fix," which GrapheneOS suggested was probably an internal mix-up.

Android 12 and 13 run the same vulnerable code, but Google no longer supports them, so those phones are unlikely to be patched unless their makers step in.

Why it matters

Most phone attacks need you to click something. This one doesn't, and it targets the one thing a phone must always do: place a call. Blaszczyk points out that someone under attack, or stuck in the reboot loop, can't reliably reach emergency services. And because a normal user's only visible way out is the recovery screen's "wipe data" option, a cheap attack can push people toward a factory reset that erases their data.

It's also another reminder of Android's update gap. Google can fix the code, but your phone's maker and carrier decide when the patch reaches you.

What to do

Check that your phone's Android security update is dated October 2026 or later, and install any pending update. Our guide shows how to check your Android security patch level and install the latest update on Pixel, Samsung Galaxy and other phones. If your phone ever lands on a recovery screen offering "Wipe data," don't pick it. Blaszczyk's writeup links a recovery method that uses a computer and Android Debug Bridge (ADB) to delete only the bad messages.

Sources: Mark Blaszczyk's writeup, BleepingComputer, heise online and Cybernews.