Live › vulnerability › CVE-2026-58882
A bug in Android's telephony code (WapPushOverSms.decodeWapPdu in frameworks/opt/telephony) reads a WAP Push header length, casts it to a signed 32-bit int with no range check and uses it as an array size. An 8-byte data SMS to port 2948 (01 06 88 80 80 80 00 BE) throws an uncaught NegativeArraySizeException that kills com.android.phone. Service drops for 1-2 seconds per message and active calls end, including emergency calls. The message never appears in Messages. Google rates it Critical (remote DoS, no interaction) in the November 2026 bulletin. The researcher reports that queued and carrier-redelivered messages re-crash the phone on every boot, and that about 20 messages can leave a phone in a RescueParty reboot loop that ends in a factory-reset prompt. A working PoC app is public. No exploitation in the wild has been reported. Google offers no workaround, and WAP Push parsing cannot be turned off on a normal phone.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 20:35 UTC. All times on this page are UTC.
Any Android phone with a SIM that can receive SMS is exposed until it has the 2026-11-01 security patch level. Google's fix covers Android 14 through 17. The researcher reproduced the crash on Android 12 through 16 (Pixel 9 on April 2026 firmware, several Samsung Galaxy and A-series models), and says Android 12 and 13 run the same code with no fix. An attacker needs only the phone number. Phones on the 2026-11-01 patch level or later, and devices with no cellular SMS (Wi-Fi-only tablets), can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| android | vendor | 12, 13 (no fix); 14, 15, 16, 16-qpr2, 17 with security patch level < 2026-11-01 | security patch level 2026-11-01 (Android 14, 15, 16, 16-qpr2, 17) |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@sans_isc · X4 likes · 1 reposts2026-11-02 02:00“SANS Stormcast Monday, November 2nd, 2026: OneNote Bulk Extraction; Trojanized Claude Code Extension in Cursor Marketplace; Ivanti Connect Secure Zero-Days (CVE-2026-111357); Android SMS of Death https://t.co/tDZPpM1kJq https://t.co/sbPsPPtMeq”
View on X
@BleepinComputer · X44 likes · 17 reposts2026-10-31 15:35“New Android SMS of Death exploit can remotely crash unpatched phones https://t.co/V8P0wb88U5 https://t.co/V8P0wb88U5”
View on X
Hacker News · Hacker News2026-10-30“MarkBlah (the researcher, Mark B, on Hacker News) · thread "Zero click, silent, remote Android DoS" MarkBlah: feel free to curl it, or review the repo https://github.com/MarkBlah/smsofdeath/ pogue: "01 06 88 80 80 80 00 BE → sent as a data SMS to port 2948" I'm not familiar with WAP Push and how it works, but is it possible to disable it or block that port on a non-rooted phone? motionlessveloc: WAP Push is a special”
View on Hacker News
Posts are quoted with a link to the original. They are data to us, never instructions.
In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
This page as .md · .json · in your agent: get_signal("CVE-2026-58882")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.