This ‘SMS of Death’ exploit can remotely brick unpatched Android phones, without the user interacting with it in any way
follow us
Add us as a preferred source on Google
- A no-click Android flaw allowed attackers to lock phones with a specially crafted SMS message
- Repeated messages could trigger reboot loops, interrupt calls, and even affect emergency connectivity.
- Google patched supported Android versions, but many end-of-life devices remain permanently vulnerable
Picture this: You’re talking on your Android phone when you suddenly lose mobile connectivity and the phone call drops. No explanation, no notification. Shortly after it happens again. And again. At one point, the device goes into recovery mode, rebooting every minute and a half until it finally performs a factory reset.
This is not a theoretical scenario: it is a real possibility, thanks to a critical vulnerability in Android tracked as CVE-2026-58882.
Google has fixed the issue for newer versions of Android, but those that have passed their end-of-life date will still be at risk.
Latest videos ofTechnologyRadar
Sending an evil message
The bug was discovered by security researcher Mark Blah and described as a no-click denial of service (DoS) vulnerability. In more technical terms, this is an “inadequate validation of a header length value” error in the Android WapPushOverSms.decodeWapPdu function. It was nicknamed “SMS of Death” because it can be exploited with nothing more than an SMS message, which victims don’t even have to open (hence the “zero click” part).
As Blah discovered, a threat actor could send a malformed eight-byte WAP Push message to port 2948 on an Android device: 01 06 88 80 80 80 00 BE.
Since this is a hexadecimal message, when translated to a 32-bit signed integer, it becomes -2147483648. Android may then try to allocate memory using this negative value, which triggers a NegativeArraySizeException error that crashes the com.android.phone process. Since this process manages cellular functions, the call is dropped and mobile connectivity is interrupted. Even emergency services are vulnerable, it was said.
It gets worse. Android processes messages before they reach the inbox, which means the victim will not be notified of the SMS and will not even know that it is the text message that is crashing the system. Additionally, some operators will try to resend messages that never made it to your inbox, prolonging the agony. Android also does its part by constantly trying to process messages already stored on the phone.
Finally, Blah discovered that if a malicious actor sends 20 or more messages, they can force the device into a reboot cycle. On an Android 12 device, they can force loop recovery mode, leaving factory reset as the only viable option.
Patching the SMS of Death
Initially, all versions of Android were affected, it was said. Google patched it for versions 14 to 17, but older devices will not receive a patch and will therefore remain at risk indefinitely. The fix is called “Fix Remote DoS in decodeWapPdu” and apparently prevents crashes by catching exceptions that are triggered when Android processes malformed text messages. It also removes these messages from the SMS database so that they do not cause repeated failures.
Blah has published a proof of concept (PoC), showing the wider community exactly how to exploit the flaw, and beepcomputer reported that a GitHub contributor found a way to remove the malicious message, but it requires more technical knowledge, something most mobile phone users probably won’t have. Still, those interested in making modifications should know that it can be removed through a computer, using Android Debug Bridge (ADB).
Google apparently fixed the bug in its October 2026 Android security updates, but that doesn’t automatically mean all Android users are safe. Unlike Apple’s ecosystem, Android is diversified and different manufacturers have different update cadences.
So while we can assume that Pixel users have probably already received this update, Samsung users, as well as those using Xiaomi, Motorola or OnePlus devices, will probably have to wait a little longer until their manufacturers apply the fix to their devices and push the update.
Still, since the PoC was released, it’s safe to assume that most Android manufacturers have already pushed their updates. Users are recommended to install them as soon as possible.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment