Ing. Calogero Bono
A single tampered WAP Push message can crash the telephony of an Android smartphone, cut off calls and, in some cases, cause continuous reboots. The flaw is called CVE-2026-58882 and was made public on October 29 by researcher Mark Blaszczyk. You don't need to open anything, and Google's fix doesn't cover every version. For those managing company phones, the issue is a concrete one.
A few terms before we get into the facts. CVE is the code that uniquely identifies a known vulnerability. WAP Push is a type of message that the system processes automatically and that may not appear in the SMS inbox. Denial of service refers to an attack that steals no data but stops the device from working. Bootloop is the cycle of continuous reboots. ADB is the computer tool used to communicate with an Android phone.
What is SMS of Death and how does it work?
According to DDay, the flaw concerns the handling of WAP Push messages, processed directly by Android's telephony framework. A malformed message crashes the com.android.phone process and the phone briefly loses its cellular network.
As Punto Informatico reports, the altered header contains a negative value (-2.147.483.648) that generates an exception during memory allocation. All of this happens before the SMS reaches the message list, so the victim sees nothing suspicious.
How much damage can a single message do?
A single crash lasts a few seconds, because Android restarts the telephony process. If a call is in progress at that moment, it drops, including calls to emergency services.
The problem repeats if the carrier tries to deliver the message again or if the content stays in the queue and gets reprocessed. HDblog reports that as few as 20 messages are enough to trigger a reboot loop. On a device running Android 12, the phone entered recovery mode roughly every 90 seconds.
Getting it working again required a factory reset. The researcher also described an ADB procedure to delete the problematic messages, but it requires a computer and technical skills.
Is any data at risk?
No, according to DDay. The vulnerability doesn't allow stealing passwords, photos or other personal data. It is a denial of service attack aimed at cellular connectivity.
Again according to DDay, no large-scale campaigns exploiting it have been identified so far. The researcher reported it to Google on May 5 and published the details on October 29, after reproducing the attack on Google Pixel and Samsung Galaxy devices.
Who is protected and who remains exposed?
The fix, according to the researcher's account, was developed in June and distributed with October updates for Android 14 through 17. For Pixels still supported, the patch level is October 5, 2026.
Android 12 and 13 contain the vulnerable code, but the fix hasn't been distributed because those systems are out of support. Anyone still on them without manufacturer updates is exposed. Punto Informatico notes that the update has reached only a few devices. The picture recalls the data on the slow rollout of Android 17.
Limits to know
The code CVE-2026-58882 does not explicitly appear in Android's October security bulletin, which nonetheless lists other DoS flaws in the framework. The fix date and the protection of patched devices come from the researcher's reconstruction, not from a confirmation by Google in the sources. We don't know how many phones are actually exposed or whether targeted exploitation exists.
What changes for those working in digital
For a company that provides phones to its employees, the risk is the interruption of calls and availability, not data leakage. It's worth knowing which models and Android versions are in use. Devices running Android 12 or 13 should be considered exposed as long as they remain unpatched. Patch management isn't only about phones – the same discipline applies to websites, as we explain when discussing CVE monitoring.
Our take
The case highlights Android's long-standing limitation. The fix has existed for months, but the work of those who develop it is wasted if the manufacturer doesn't distribute it or if the phone is out of support. It's also striking that the identifier isn't in the October bulletin, a detail that complicates the job of anyone trying to verify the status of their devices. The risk is limited, but affecting emergency calls makes it serious.
Frequently asked questions
Do I have to open the SMS to be hit?
No. The flaw is triggered while the system processes the message. You don't need to open it, tap links or download attachments.
Does SMS of Death steal my data?
No. According to DDay, it doesn't allow stealing passwords, photos or personal data. It aims to stop the phone from working, especially its cellular connectivity.
Which Android versions are protected?
Android 14, 15, 16 and 17 with the October patch, according to the researcher. Android 12 and 13 contain the vulnerable code and have not received the fix.
What do I do if the phone gets stuck in a bootloop?
A factory reset works, but it erases your data. Alternatively, there is an ADB procedure to delete the problematic messages, which requires a computer and technical skills.
Do emergency calls drop too?
Yes. Sources report that the crash interrupts ongoing calls, including those to emergency services. A single crash lasts a few seconds.
What to watch for in the coming weeks on Android patches
The outcome depends on the updates that actually reach phones. It's worth keeping an eye on a few signals.
- Check that updated phones show the October or later patch level.
- Follow whether Google adds CVE-2026-58882 to its security bulletins.
- Replace or isolate devices running Android 12 and 13 that no longer receive updates.
