Follow us
Add us as a preferred source on Google
Late last week, a report surfaced about a new Android phone exploit security researchers dubbed “SMS of Death.” According to the report, the attack, tracked as “CVE-2026-58882”, allows malicious actors to disrupt mobile phone service or crash Android phones by overloading them with a repetitively crafted SMS text message.
The denial error can even interrupt ongoing calls, including emergency calls, without you having to open the message. Apparently, the Android operating system processes the message before it even reaches your SMS inbox, which means that you will not immediately understand what the phone crashed.
Researcher Mark Blah says that even if you restart your phone, the hacked message “remains in the queue and is retried on every boot, so the phone may crash on startup until it is cleared (recovery below).”
Latest Videos FromTom the guide
After finding Blah’s report, Tom’s Guide contacted Google because the report claimed that Google considered it a “non-priority”. Google has not yet responded to our inquiries.
However, some Android phones may already have the exploit patched.
October patch
Blah’s report noted that the exploit affects Android versions 12 through 16 and was discovered on several devices, including Pixel 9s and Samsung Galaxy phones.
It appears that Google patched the exploit in the October 2026 Android security update (if you haven’t updated your Android phone, you should). However, that’s only for Android versions 14 to 17. It doesn’t seem to be available for devices still running Android 12 or 13.
Per Blah, the bug uses an incorrect validation of a header length in the Android WapPushOverSms.decodeWapPdu function. Attackers send a false WAP push message to the targeted phone.
When this message is translated into a negative value Android tries to allocate memory, which causes a NegativeArraySizeException that aborts the com.android.phone process.
This process controls cellular functions, which disrupts connectivity and disconnects calls. This causes repeated crashes as the network tries to retrieve the malicious messages that pile up forcing Android to process each one. It only takes 20 bad messages to cause the crash.
Per the Google fix, the crash is prevented by catching the exceptions thrown by the attack messages. Then the patch deletes the messages from the SMS database to prevent them from hitting.
What you need to do
Android security updates are usually installed automatically on supported devices. So you should already have them.
However, availability depends on the phone manufacturer and network operator. So you should check your phone to see if the October patch has been applied. A reboot may be required to complete the installation.
For the most part, this isn’t an attack you can do anything about, but based on the patch notes and Blah’s report, it doesn’t seem to be widely used; instead, it seems to target individual cell phones. Since a working proof of concept of the exploit has been released, the best thing you can do is make sure you keep your phone up to date.
follow Tom’s Guide to Google News in the add us as a preferred source to get our latest news, analysis and reviews in your feeds.