--- id: "CVE-2026-58882" kind: "vulnerability" aliases: ["CVE-2026-58882"] title: "Android \"SMS of Death\": one malformed WAP Push text crashes the phone service and drops calls, including emergency calls" severity: "critical" cvss: null epss: null exploited: false status: "open" category: "runtime" products: [{"name": "android", "fixed": ["security patch level 2026-11-01 (Android 14, 15, 16, 16-qpr2, 17)"], "affected": "12, 13 (no fix); 14, 15, 16, 16-qpr2, 17 with security patch level < 2026-11-01", "ecosystem": "vendor"}] ecosystems: [] tags: ["android", "denial-of-service", "emergency-calls", "end-of-life", "mobile", "poc-public", "runtime", "sms", "telephony", "zero-click"] not_affected_if: ["no-cellular", "patched-device"] published_at: "2026-11-02T20:17:50+00:00" first_seen_at: "2026-11-02T20:35:32+00:00" updated_at: "2026-11-02T20:40:41+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58882", "first_seen_at": "2026-11-02T20:35:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T20:40:41+00:00"}] --- # Android "SMS of Death": one malformed WAP Push text crashes the phone service and drops calls, including emergency calls A bug in Android's telephony code (WapPushOverSms.decodeWapPdu in frameworks/opt/telephony) reads a WAP Push header length, casts it to a signed 32-bit int with no range check and uses it as an array size. An 8-byte data SMS to port 2948 (01 06 88 80 80 80 00 BE) throws an uncaught NegativeArraySizeException that kills com.android.phone. Service drops for 1-2 seconds per message and active calls end, including emergency calls. The message never appears in Messages. Google rates it Critical (remote DoS, no interaction) in the November 2026 bulletin. The researcher reports that queued and carrier-redelivered messages re-crash the phone on every boot, and that about 20 messages can leave a phone in a RescueParty reboot loop that ends in a factory-reset prompt. A working PoC app is public. No exploitation in the wild has been reported. Google offers no workaround, and WAP Push parsing cannot be turned off on a normal phone. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:android affected 12, 13 (no fix); 14, 15, 16, 16-qpr2, 17 with security patch level < 2026-11-01 fixed security patch level 2026-11-01 (Android 14, 15, 16, 16-qpr2, 17) ## How to check On the phone: Settings > About phone, read the Android version and the Android security update (security patch level). With ADB: adb shell getprop ro.build.version.release and adb shell getprop ro.build.version.security_patch. You are exposed if the phone runs Android 12 or 13 (Google ships no fix for them), or runs Android 14, 15, 16 or 17 with a patch level earlier than 2026-11-01. For a fleet, read the security patch level from your MDM inventory. Signs of an attack: com.android.phone crashing with java.lang.NegativeArraySizeException in WapPushOverSms.decodeWapPdu (adb logcat -b crash), loss of signal for a second or two at a time, or reboots into recovery about every 90 seconds with --reason=RescueParty. Also check custom ROMs (LineageOS, CalyxOS, GrapheneOS): they pick up the AOSP commit on their own schedule. If a phone is already stuck in the loop, a community ADB method (smsofdeath issue #2, not from Google) avoids a factory reset. Right after boot, find the rows in content://sms/raw with destination_port 134020, run adb shell cmd appops set com.android.shell WRITE_SMS allow, delete those rows, then set the permission back to default. Do not pick wipe data at the recovery prompt. ## Fix Install the Android security update with patch level 2026-11-01 or later (November 2026 Android Security Bulletin, CVE-2026-58882, A-517376969). Updated AOSP versions: 14, 15, 16, 16-qpr2, 17. The code fix is AOSP frameworks/opt/telephony commit 735d967, "Fix remote DoS in decodeWapPdu". It catches RuntimeException during WAP Push decoding and deletes the bad message from the raw SMS table, which breaks the re-crash loop. Google's bulletin lists the fix at the 2026-11-01 patch level, so treat that as the confirmed fixed level. The researcher reports that some October 2026 updates already carried the commit. Android 12 and 13 are not in Google's updated list: replace or upgrade those devices. ## Timeline - 2026-11-02T20:35:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58882 - 2026-11-02T20:40:41+00:00 analyst — November 2026 Android bulletin lists CVE-2026-58882 (A-517376969, System, DoS) as Critical, fixed at patch level 2026-11-01 for AOSP 14-17. Fix is AOSP commit 735d967. The researcher's write-up and PoC (smsofdeath.com, github MarkBlah/smsofdeath) report it shipped in October and confirm Android 12/13 are affected with no fix. Severity raised to critical on Google's own rating. Not exploited in the wild; PoC public. Only fix verified: the 12/13 scope comes from the researcher. Sibling CVE-2026-58814 (A-517378147, System DoS, Critical) sits in the same bulletin. X credits depleted (402), so no X search. ## Documents - [advisory] Android Security Bulletin—November 2026 https://source.android.com/docs/security/bulletin/2026/2026-11-01 - [describes] SMS of Death: zero-click Android telephony DoS (researcher write-up, Mark B) https://smsofdeath.com/ - [describes] smsofdeath issue #2: ADB workaround for a phone stuck in the reboot loop (Android 12) https://github.com/MarkBlah/smsofdeath/issues/2 - [discussion] @BleepinComputer: New Android SMS of Death exploit can remotely crash unpatched phones https://t.c https://x.com/BleepinComputer/status/2116554653919768686 - [discussion] @sans_isc: SANS Stormcast Monday, November 2nd, 2026: OneNote Bulk Extraction; Trojanized C https://x.com/sans_isc/status/2117074437111685423 - [discussion] Hacker News: Zero click, silent, remote Android DoS (researcher MarkBlah in thread) https://news.ycombinator.com/item?id=50286194 - [fix] AOSP frameworks/opt/telephony commit 735d967: Fix remote DoS in decodeWapPdu (b/517376969) https://android.googlesource.com/platform/frameworks/opt/telephony/+/735d9672603fa206c4b43cb668c1aa273db70b97%5E%21/ - [mentions] BleepingComputer: New Android SMS of Death exploit can remotely crash unpatched phones https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/ - [poc] MarkBlah/smsofdeath: PoC app sending the 8-byte WAP Push PDU to port 2948 https://github.com/MarkBlah/smsofdeath/ ## From the sources In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_