Exploit released for Android 'SMS of Death' bug that knocks phones off the network

A security researcher has published a working exploit for an Android bug that lets anyone who knows your phone number knock the phone off the cellular network with a single hidden text message. The flaw, which the researcher calls "SMS of Death" and BleepingComputer tracks as CVE-2026-58882, crashes the system process that handles calls and mobile data, and it can cut off a call to emergency services while it is in progress. Google fixed it in the October 2026 Android security update for Android 14 through 17. Phones on Android 12 and 13 do not get that fix, BleepingComputer reported on 31 October.

The attack uses WAP Push, an old SMS format that operators use to send settings and service messages to phones. According to the technical write-up by researcher Mark B, Android reads a length value from the message header and turns it into a negative number without checking it. When the system then tries to reserve memory of that size, the com.android.phone process crashes. That process runs calls, SMS and mobile data, so the phone loses signal for a second or two and any active call drops.

The victim does not have to tap or open anything. The message arrives as a data SMS, never appears in the messaging app, and the sender's number is not shown. The researcher says the crash was reproduced on Android versions from 12 to 16, with a 100% success rate on a Pixel 9 running April 2026 firmware and on several Samsung Galaxy models.

Read the full article on vpnlab.io: https://vpnlab.io/en/android-sms-of-death-exploit-cve-2026-58882-3162