Android users face SMS flaw that can crash phones

A security researcher named Mark Blaszczyk uncovered a flaw in Android that can crash a phone with a single crafted text message. Dubbed “SMS of Death” and tracked as CVE-2026-58882, the bug lets an attacker remotely disrupt cellular service, cut off ongoing calls – including emergency calls – and trap the device in a reboot loop. The recipient does not need to open the message. Blaszczyk first alerted Google in May, and on 29 October he published a working demonstration that reproduced the attack on Google Pixel and Samsung Galaxy phones.

How the exploit works

The flaw lies in how Android handles WAP Push messages, which the system processes before they reach the regular SMS inbox. A malformed eight-byte packet can cause the telephony framework to interpret a negative array size, triggering a NegativeArraySizeException that crashes the com.android.phone process. Because that process controls cellular functions, the crash can sever active calls. If the carrier retries delivery, the phone can be trapped in a repeated reboot loop. In tests, about 20 such messages were enough to lock a phone into continuous reboots. The researcher also built a proof-of-concept that sends the payload from another Android device.

Google reportedly issued a patch in its October 2026 security updates covering Android 14 to 17, but the fix was not listed in the public bulletin. Android 12 and 13 devices remain exposed because they did not receive the update. Users can check their security patch level in the Settings menu, though the location varies by manufacturer, and install the latest update once it is available. Availability depends on the manufacturer and carrier. A GitHub contributor found that the malicious messages can be removed with Android Debug Bridge, but that method requires advanced technical knowledge and a computer.