---
id: "TECH-202610-android-sms-of-death-cve-2026-58882-one-crafted-text-message"
kind: "technique"
aliases: []
title: "Android 'SMS of Death' (CVE-2026-58882): one crafted text message crashes the phone's cellular service, with public exploit code; Android 12 and 13 get no fix"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Android", "fixed": ["2026-10 security update (Android 14-17)"], "vendor": "Google", "affected": "Android 12, 13 (no fix); Android 14-17 before 2026-10 security patch"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-31T16:06:09+00:00"
updated_at: "2026-10-31T16:06:18+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-31T16:06:09+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T16:06:18+00:00"}]
---

# Android 'SMS of Death' (CVE-2026-58882): one crafted text message crashes the phone's cellular service, with public exploit code; Android 12 and 13 get no fix

A malformed 8-byte WAP Push message, sent as a data SMS to port 2948, makes WapPushOverSms.decodeWapPdu in Android's telephony framework throw a NegativeArraySizeException, crashing com.android.phone. It needs no user action and leaves nothing in the SMS inbox. It cuts cellular service and drops calls in progress, emergency calls included. Repeated or redelivered messages cause reboot loops: in testing, 20 messages did this, and one Android 12 device needed a factory reset. Android 14 to 17 are fixed in the October 2026 security updates (patch 'Fix remote DoS in decodeWapPdu'), but the flaw is not listed in Google's October bulletin. Android 12 and 13 got no fix. Researcher Mark Blah published a working PoC (github.com/MarkBlah/smsofdeath, write-up at smsofdeath.com) on 2026-10-31. Exploitation in the wild: unknown. At risk: company phones and field or on-call staff on unpatched or old Android.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Android affected Android 12, 13 (no fix); Android 14-17 before 2026-10 security patch fixed 2026-10 security update (Android 14-17)

## How to check

List managed Android devices on Android 12 or 13, or on a security patch level older than 2026-10. Signs of an attack: com.android.phone keeps crashing, cellular service drops or the phone reboots in a loop with nothing new in the SMS inbox, and a NegativeArraySizeException from WapPushOverSms.decodeWapPdu shows up in logcat.

## Fix

Install the October 2026 (or later) Android security update on Android 14 to 17. Android 12 and 13 devices will not be fixed: plan to replace or upgrade them, and do not rely on them for emergency or on-call calls. To recover a device stuck in a crash loop, remove the stored malicious messages over ADB (a method found by a GitHub contributor, Sakis, per BleepingComputer) or factory reset it.

## Timeline

- 2026-10-31T16:06:09+00:00 analyst
- 2026-10-31T16:06:18+00:00 analyst — Corrected where the ADB cleanup method comes from

## Documents

- [describes] @BleepinComputer: New Android SMS of Death exploit can remotely crash unpatched phones
https://t.c https://x.com/BleepinComputer/status/2116554653919768686
- [mentions] BleepingComputer: New Android SMS of Death exploit can remotely crash unpatched phones https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_