A security researcher has disclosed a flaw in Android that lets an attacker crash a phone’s calling service with a single text message the owner never sees. The message needs no tap, no link and no reply. Android handles it before it reaches the inbox, and the crash can drop a call in progress, including a call to emergency services. Google has fixed the flaw for newer Android versions, but phones on Android 12 and 13 did not receive the fix.
What the flaw does
The vulnerability, tracked as CVE-2026-58882 and nicknamed the SMS of Death, is a denial-of-service flaw, not a way to steal data or take over a phone. It targets the part of Android that manages cellular service, the com.android.phone process. When that process crashes, the handset loses mobile service while Android restarts it, and any call underway is cut off.
Nothing in the published research suggests the flaw exposes photos, messages or passwords. The danger is the combination of invisibility and reach. Because the malicious message is processed before it appears in the messaging app, the victim gets no warning and no visible trace of what happened. A phone that suddenly drops a call looks like an ordinary network glitch.
How one message breaks the phone
The flaw sits in how Android handles WAP Push messages, an older carrier format still used for multimedia-message notifications and carrier settings. The researcher found that Android’s WapPushOverSms component reads a header-length value from the message without checking that the value makes sense. A crafted eight-byte message, sent as a data SMS to a specific port, turns that value negative.
Android then tries to set aside memory based on that negative number, which triggers an exception and crashes the phone process. The researcher reproduced the crash on a Google Pixel 9 and several Samsung Galaxy phones, and found the vulnerable code in Android 12 and later. The attack needs no interaction, which is why it is classed as zero-click.
When one message becomes many
A single crash is disruptive, but repeated messages make the flaw far worse. The researcher found that sending twenty malicious messages could leave phones stuck in reboot loops, as Android reprocessed the poisoned messages. On one Android 12 device, the phone rebooted into recovery mode roughly every 90 seconds, and the owner could only recover it with a factory reset.
A factory reset wipes the device, so recovery can cost as much as the attack. Carriers can make the problem recur by redelivering messages, and Android can reprocess stored messages. A community contributor found a workaround using Android Debug Bridge to delete the malicious messages. That route needs a computer and expertise, so it is no answer for most owners.
Who is fixed, and who is not
Google’s fix, titled Fix remote DoS in decodeWapPdu, catches the exception instead of crashing the phone process. It deletes the malicious messages from the SMS database so they cannot trigger again. According to the researcher, the fix reached Android 14 through 17 in Google’s October 2026 security updates. Phones on those versions with the October update installed should be protected.
Updates arrive through manufacturers and carriers, and a restart may be needed to finish installation. Android 12 and 13 devices are the gap: those versions did not receive the fix, and they run the same faulty code, so they stay vulnerable even after their owners install every update offered to them.
The patch gap in the bulletin
There is an odd wrinkle in the disclosure: the flaw does not appear in Google’s October security bulletin, even though the fix reportedly shipped in the October updates. Readers who checked the bulletin to decide whether to update would not have found it there.
That confusion leaves owners with a practical rule rather than a clean one. A phone on Android 14 or later with an October 2026 patch level or newer is the level the researcher lists as protected. Until Google explains the bulletin gap publicly, the patch date is the best guide available, and it is a guide rather than a guarantee.
Original analysis: what this changes, and what it does not
This disclosure changes the stakes of an old argument about how long phones should be supported. A flaw in a legacy message format, present since Android 12, can still reach millions of handsets years later. The fix only helps owners whose devices are still inside their update window.
It also shows how disclosure timing shapes risk. The researcher reported the flaw to Google in May 2026, the fix was written in June, and the public proof-of-concept exploit arrived at the end of October. That sequence is responsible disclosure working as intended for newer phones, yet it still leaves older phones exposed.
A separate wave of disclosed platform breaches arrived the same week, and the Black October research shows how quickly a published proof of concept can move from report to real-world probing. What this flaw does not change is the threat’s nature: it is a crash, not a takeover, and there are no confirmed attacks in the wild so far.
Why It Matters
Emergency calling is the line that turns a nuisance into a safety issue. A flaw that can drop a call to emergency services, triggered silently by a stranger, is significant even though it steals nothing. It also exposes a weakness in Android’s update chain: Google can write a fix, but manufacturers and carriers decide when it arrives.
The result is a two-tier safety net, where the newest phones are patched and the oldest are not. For the wider industry, the flaw is a reminder that legacy protocols do not retire when attention moves on. WAP Push is old, obscure and still active in the background of modern phones, and its code carried an unchecked value for years.
Background
Android’s security updates come from Google via device makers and carriers, so two phones on one Android version can get fixes weeks apart. The framework behind this flaw stays tied to the platform version. Android’s developer tools keep expanding, as rival AI agents in Android Studio showed, but that reach means little if the phone cannot hold a call.
Source: BleepingComputer report
0 Comments