Live › technique › TECH-202610-android-sms-of-death-cve-2026-58882-one-crafted-text-message

high⚡ Early warning · no CVE yetSMS of DeathRuntime

Android 'SMS of Death' (CVE-2026-58882): one crafted text message crashes the phone's cellular service, with public exploit code; Android 12 and 13 get no fix

A malformed 8-byte WAP Push message, sent as a data SMS to port 2948, makes WapPushOverSms.decodeWapPdu in Android's telephony framework throw a NegativeArraySizeException, crashing com.android.phone. It needs no user action and leaves nothing in the SMS inbox. It cuts cellular service and drops calls in progress, emergency calls included. Repeated or redelivered messages cause reboot loops: in testing, 20 messages did this, and one Android 12 device needed a factory reset. Android 14 to 17 are fixed in the October 2026 security updates (patch 'Fix remote DoS in decodeWapPdu'), but the flaw is not listed in Google's October bulletin. Android 12 and 13 got no fix. Researcher Mark Blah published a working PoC (github.com/MarkBlah/smsofdeath, write-up at smsofdeath.com) on 2026-10-31. Exploitation in the wild: unknown. At risk: company phones and field or on-call staff on unpatched or old Android.

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

high

no CVSS yet; severity from the sources

known so far4 of 6

missing: primary source, exploitation

First public: Oct 31, 2026 UTC
Last modified: Oct 31, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-31 16:06 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
Android	–	Android 12, 13 (no fix); Android 14-17 before 2026-10 security patch	2026-10 security update (Android 14-17)

Who cares: early-warning, technique
Not affected if: –

How to check

List managed Android devices on Android 12 or 13, or on a security patch level older than 2026-10
Signs of an attack: com.android.phone keeps crashing, cellular service drops or the phone reboots in a loop with nothing new in the SMS inbox, and a NegativeArraySizeException from WapPushOverSms.decodeWapPdu shows up in logcat

The fix

Install the October 2026 (or later) Android security update on Android 14 to 17
Android 12 and 13 devices will not be fixed: plan to replace or upgrade them, and do not rely on them for emergency or on-call calls
To recover a device stuck in a crash loop, remove the stored malicious messages over ADB (a method found by a GitHub contributor, Sakis, per BleepingComputer) or factory reset it

Know the next one before it finds you.

Get started free

Android 'SMS of Death' (CVE-2026-58882): one crafted text message crashes the phone's cellular service, with public exploit code; Android 12 and 13 get no fix

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

Android

–

Android 12, 13 (no fix); Android 14-17 before 2026-10 security patch

2026-10 security update (Android 14-17)

Android 'SMS of Death' (CVE-2026-58882): one crafted text message crashes the phone's cellular service, with public exploit code; Android 12 and 13 get no fix

Who is affected

How to check

The fix

Know the next one before it finds you.

Android 'SMS of Death' (CVE-2026-58882): one crafted text message crashes the phone's cellular service, with public exploit code; Android 12 and 13 get no fix

Who is affected

How to check

The fix

Know the next one before it finds you.

Who had it, and when

Sources