Malformed text message can crash unpatched Android phones, no tap needed

A single malformed text message can knock an unpatched Android phone offline, and the person holding it never has to open anything. The flaw is tracked as CVE-2026-58882 and rated critical. Researcher Mark Blah, who found it, calls it a zero-click denial-of-service bug, nicknamed “SMS of Death.” ¹

The fault sits in Android’s WapPushOverSms.decodeWapPdu function, which fails to properly check a header-length value. An attacker sends an eight-byte WAP Push message (a type of special-purpose text) to port 2948. Read as a signed 32-bit integer, the length becomes a large negative number. Android then tries to allocate memory with it, throws a NegativeArraySizeException error, and crashes the com.android.phone process. That process runs cellular functions, so calls drop and mobile connectivity goes with it. Emergency services are affected too. ¹

The message is processed before it reaches the inbox, so the victim sees no notification. Some carriers retry messages that never arrived, and Android keeps trying to process messages already stored on the phone. Blah found that 20 or more messages can force a reboot loop. On an Android 12 device, that can mean looped recovery mode, with a factory reset the only way out. ¹

Seen it before: a length field nobody checked, in a parser that trusted its input. It is the oldest bug in the building.

Google’s fix, “Fix remote DoS in decodeWapPdu,” catches the exception and deletes the offending messages from the SMS database so they cannot trigger repeat crashes. It covers Android 14 through 17. Older versions will not get a patch and remain at risk indefinitely. ¹

Blah has published a proof-of-concept. BleepingComputer reported that a GitHub contributor found a way to remove the malicious message using Android Debug Bridge from a computer, though it takes technical skill. ¹

What you should do: install the latest Android security update as soon as your manufacturer ships it. Google reportedly patched the bug in its October 2026 updates, but Samsung, Xiaomi, Motorola and OnePlus owners may wait longer than Pixel users. ¹

Our read: the bug is simple, the exploit is public, and the unpatched pool is the story. If your phone is on Android 13 or earlier, nothing in the reporting suggests a fix is coming. Whether carriers filter these messages is not covered, and that is the question to watch.

Footnotes

1. TechRadar, “This ‘SMS of Death’ exploit can remotely crash unpatched Android phones — without the user interacting with it in any way”. Retrieved November 2, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶