{"id":"CVE-2026-58882","kind":"vulnerability","aliases":["CVE-2026-58882"],"related":[],"title":"Android \"SMS of Death\": one malformed WAP Push text crashes the phone service and drops calls, including emergency calls","description":"In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A bug in Android's telephony code (WapPushOverSms.decodeWapPdu in frameworks/opt/telephony) reads a WAP Push header length, casts it to a signed 32-bit int with no range check and uses it as an array size. An 8-byte data SMS to port 2948 (01 06 88 80 80 80 00 BE) throws an uncaught NegativeArraySizeException that kills com.android.phone. Service drops for 1-2 seconds per message and active calls end, including emergency calls. The message never appears in Messages. Google rates it Critical (remote DoS, no interaction) in the November 2026 bulletin. The researcher reports that queued and carrier-redelivered messages re-crash the phone on every boot, and that about 20 messages can leave a phone in a RescueParty reboot loop that ends in a factory-reset prompt. A working PoC app is public. No exploitation in the wild has been reported. Google offers no workaround, and WAP Push parsing cannot be turned off on a normal phone.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"android","fixed":["security patch level 2026-11-01 (Android 14, 15, 16, 16-qpr2, 17)"],"affected":"12, 13 (no fix); 14, 15, 16, 16-qpr2, 17 with security patch level < 2026-11-01","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","denial-of-service","emergency-calls","end-of-life","mobile","poc-public","runtime","sms","telephony","zero-click"],"not_affected_if":["no-cellular","patched-device"],"how_to_check":"On the phone: Settings > About phone, read the Android version and the Android security update (security patch level). With ADB: adb shell getprop ro.build.version.release and adb shell getprop ro.build.version.security_patch. You are exposed if the phone runs Android 12 or 13 (Google ships no fix for them), or runs Android 14, 15, 16 or 17 with a patch level earlier than 2026-11-01. For a fleet, read the security patch level from your MDM inventory. Signs of an attack: com.android.phone crashing with java.lang.NegativeArraySizeException in WapPushOverSms.decodeWapPdu (adb logcat -b crash), loss of signal for a second or two at a time, or reboots into recovery about every 90 seconds with --reason=RescueParty. Also check custom ROMs (LineageOS, CalyxOS, GrapheneOS): they pick up the AOSP commit on their own schedule. If a phone is already stuck in the loop, a community ADB method (smsofdeath issue #2, not from Google) avoids a factory reset. Right after boot, find the rows in content://sms/raw with destination_port 134020, run adb shell cmd appops set com.android.shell WRITE_SMS allow, delete those rows, then set the permission back to default. Do not pick wipe data at the recovery prompt.","fix":"Install the Android security update with patch level 2026-11-01 or later (November 2026 Android Security Bulletin, CVE-2026-58882, A-517376969). Updated AOSP versions: 14, 15, 16, 16-qpr2, 17. The code fix is AOSP frameworks/opt/telephony commit 735d967, \"Fix remote DoS in decodeWapPdu\". It catches RuntimeException during WAP Push decoding and deletes the bad message from the raw SMS table, which breaks the re-crash loop. Google's bulletin lists the fix at the 2026-11-01 patch level, so treat that as the confirmed fixed level. The researcher reports that some October 2026 updates already carried the commit. Android 12 and 13 are not in Google's updated list: replace or upgrade those devices.","status":"open","published_at":"2026-11-02T20:17:50+00:00","first_seen_at":"2026-11-02T20:35:32+00:00","triaged_at":"2026-11-02T20:38:52+00:00","updated_at":"2026-11-02T20:40:41+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-02T20:38:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Android: WAP push SMS parsing flaw lets remote senders crash phones","impact":"low","summary":"A flaw in how Android decodes WAP push messages (decodeWapPdu in WapPushOverSms.java) causes an out-of-bounds read from an integer overflow. A remote sender can crash the phone without any user interaction.","audience":"everyone","category":"runtime","nicknames":["SMS of Death"],"who_cares":["android","mobile","sms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"remote denial of service, phone crashes or restarts","analyst_note":"Find the Android security bulletin entry for CVE-2026-58882 to confirm affected versions and the patched build; the BleepingComputer article may name the affected releases.","how_to_check":"- unknown","plain_action":"Install the latest Android security update on your phone once your manufacturer releases it.","needs_analyst":true,"not_affected_if":["patched-device"],"who_is_affected":"Android phones that receive SMS and have not received a patch addressing this flaw. The sources do not say which Android versions are affected, and no special setup is described. Devices that are fully patched are not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":4135,"output_tokens":466,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Android security bulletin entry for CVE-2026-58882 to confirm affected versions and the patched build; the BleepingComputer article may name the affected releases.","search":"'-2':114B '-2026':21A,24A '-58882':22A,25A '00':101B '01':95B '06':96B '1':113B '20':165B '2026':142B '2948':94B '32':73B '8':88B '80':98B,99B,100B '88':97B 'activ':119B 'addit':242C 'android':1A,29A,30B,55B 'app':187B 'appear':128B 'array':85B 'bit':74B 'boot':161B 'bound':224C 'bug':53B 'bulletin':143B 'byte':89B 'call':16A,19A,37B,120B,124B 'cannot':206B 'carrier':151B 'carrier-redeliv':150B 'cast':68B 'check':79B 'click':51B 'code':58B 'com.android.phone':109B 'could':232C 'crash':10A,156B 'critic':134B 'cve':20A,23A 'data':90B 'death':4A,28A 'decodewappdu':215C 'denial':32B,237C 'denial-of-servic':31B 'dos':136B 'drop':15A,111B 'due':226C 'emerg':18A,36B,123B 'emergency-cal':35B 'end':39B,121B,177B 'end-of-lif':38B 'everi':160B 'execut':243C 'exploit':191B,252C 'factori':181B 'factory-reset':180B 'frameworks/opt/telephony':61B 'googl':131B,198B 'header':66B 'includ':17A,122B 'int':75B 'integ':229C 'interact':138B,247C 'kill':108B 'lead':233C 'leav':168B 'length':67B 'life':41B 'loop':175B 'malform':6A 'messag':117B,126B,130B,153B,166B 'mobil':42B 'need':245C,250C 'negativearraysizeexcept':106B 'never':127B 'normal':212B 'novemb':141B 'of':27A 'offer':199B 'one':5A 'overflow':230C 'pars':205B 'per':116B 'phone':12A,158B,170B,213B 'poc':44B,186B 'poc-publ':43B 'port':93B 'possibl':221C 'privileg':244C 'prompt':183B 'public':45B,189B 'push':8A,65B,204B 'queu':148B 'rang':78B 'rate':132B 're':155B 're-crash':154B 'read':62B,225C 'reboot':174B 'redeliv':152B 'remot':135B,236C 'report':146B,197B 'rescueparti':173B 'research':145B 'reset':182B 'runtim':46B 'second':115B 'servic':13A,34B,110B,239C 'sign':72B 'size':86B 'sms':2A,26A,47B,91B 'telephoni':48B,57B 'text':9A 'throw':103B 'turn':208B 'uncaught':105B 'use':81B 'user':246C 'wap':7A,64B,203B 'wappushoversms.decodewappdu':59B 'wappushoversms.java':217C 'wild':194B 'work':185B 'workaround':201B 'zero':50B 'zero-click':49B","nicknames":["SMS of Death"],"mitigations":[],"who_affected":"Any Android phone with a SIM that can receive SMS is exposed until it has the 2026-11-01 security patch level. Google's fix covers Android 14 through 17. The researcher reproduced the crash on Android 12 through 16 (Pixel 9 on April 2026 firmware, several Samsung Galaxy and A-series models), and says Android 12 and 13 run the same code with no fix. An attacker needs only the phone number. Phones on the 2026-11-01 patch level or later, and devices with no cellular SMS (Wi-Fi-only tablets), can skip it.","tier":"A","verified":{"fix":{"at":"2026-11-02T20:40:41Z","by":"analyst","doc":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/735d9672603fa206c4b43cb668c1aa273db70b97%5E%21/","run_id":1422}},"analyst_revisit_at":"2026-11-03T02:40:58+00:00","fix_status":"available","audience":"everyone","plain_action":"Update your Android phone in Settings and check under About phone that the Android security update is dated November 1, 2026 or later. If your phone runs Android 12 or 13 it will not get this fix, so plan to replace it.","pkeys":["android","smsofdeath"],"ptokens":["android"],"labels":["android","critical","denialofservice","emergencycalls","endoflife","mobile","pocpublic","runtime","sms","telephony","zeroclick"],"first_public_at":"2026-10-30T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-58882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58882","severity":null,"published_at":"2026-11-02T20:17:50+00:00","modified_at":"2026-11-02T20:17:50+00:00","first_seen_at":"2026-11-02T20:35:32+00:00","fetched_at":"2026-11-02T20:35:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-58882:1422","url":null,"severity":null,"published_at":"2026-11-02T20:40:41+00:00","modified_at":"2026-11-02T20:40:41+00:00","first_seen_at":"2026-11-02T20:40:41+00:00","fetched_at":"2026-11-02T20:40:41+00:00","note":"November 2026 Android bulletin lists CVE-2026-58882 (A-517376969, System, DoS) as Critical, fixed at patch level 2026-11-01 for AOSP 14-17. Fix is AOSP commit 735d967. The researcher's write-up and PoC (smsofdeath.com, github MarkBlah/smsofdeath) report it shipped in October and confirm Android 12/13 are affected with no fix. Severity raised to critical on Google's own rating. Not exploited in the wild; PoC public. Only fix verified: the 12/13 scope comes from the researcher. Sibling CVE-2026-58814 (A-517378147, System DoS, Critical) sits in the same bulletin. X credits depleted (402), so no X search."}],"documents":[{"id":33332,"url":"https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/","title":"BleepingComputer: New Android SMS of Death exploit can remotely crash unpatched phones","kind":"blog","source":"blog","publisher":null,"text":"New Android SMS of Death exploit can remotely crash unpatched phones\n\nA security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed \"SMS of Death\" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message. [...]","published_at":"2026-10-31T15:35:11+00:00","relation":"mentions","confidence":null,"note":null},{"id":33420,"url":"https://x.com/BleepinComputer/status/2116554653919768686","title":"@BleepinComputer: New Android SMS of Death exploit can remotely crash unpatched phones\nhttps://t.c","kind":"post","source":"x","publisher":null,"text":"New Android SMS of Death exploit can remotely crash unpatched phones\nhttps://t.co/V8P0wb88U5\n\nhttps://t.co/V8P0wb88U5\n\nlikes 44 reposts 17","published_at":"2026-10-31T15:35:27+00:00","relation":"discussion","confidence":null,"note":"@BleepinComputer"},{"id":41801,"url":"https://x.com/sans_isc/status/2117074437111685423","title":"@sans_isc: SANS Stormcast Monday, November 2nd, 2026: OneNote Bulk Extraction; Trojanized C","kind":"post","source":"x","publisher":null,"text":"SANS Stormcast Monday, November 2nd, 2026: OneNote Bulk Extraction; Trojanized Claude Code Extension in Cursor Marketplace; Ivanti Connect Secure Zero-Days (CVE-2026-111357); Android SMS of Death\n https://t.co/tDZPpM1kJq https://t.co/sbPsPPtMeq\n\nlikes 4 reposts 1","published_at":"2026-11-02T02:00:53+00:00","relation":"discussion","confidence":null,"note":"@sans_isc"},{"id":53783,"url":"https://source.android.com/docs/security/bulletin/2026/2026-11-01","title":"Android Security Bulletin—November 2026","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":53790,"url":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/735d9672603fa206c4b43cb668c1aa273db70b97%5E%21/","title":"AOSP frameworks/opt/telephony commit 735d967: Fix remote DoS in decodeWapPdu (b/517376969)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":53791,"url":"https://smsofdeath.com/","title":"SMS of Death: zero-click Android telephony DoS (researcher write-up, Mark B)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":53792,"url":"https://github.com/MarkBlah/smsofdeath/","title":"MarkBlah/smsofdeath: PoC app sending the 8-byte WAP Push PDU to port 2948","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":53793,"url":"https://github.com/MarkBlah/smsofdeath/issues/2","title":"smsofdeath issue #2: ADB workaround for a phone stuck in the reboot loop (Android 12)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":53794,"url":"https://news.ycombinator.com/item?id=50286194","title":"Hacker News: Zero click, silent, remote Android DoS (researcher MarkBlah in thread)","kind":"post","source":"analyst","publisher":null,"text":"MarkBlah (the researcher, Mark B, on Hacker News) · thread \"Zero click, silent, remote Android DoS\"\nMarkBlah: feel free to curl it, or review the repo https://github.com/MarkBlah/smsofdeath/\npogue: \"01 06 88 80 80 80 00 BE → sent as a data SMS to port 2948\" I'm not familiar with WAP Push and how it works, but is it possible to disable it or block that port on a non-rooted phone?\nmotionlessveloc: WAP Push is a specially formatted SMS that triggers your phone to download a URL. Unfortunately the vuln here appears to hit at the SMS parsing phase, which I don't think can be turned off easily.\n","published_at":"2026-10-30T00:00:00+00:00","relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}