Android SMS of Death exploit goes public as unpatched devices remain at risk

Researchers have unveiled a functional exploit targeting CVE-2026-58882, a zero-click denial-of-service vulnerability in Android that permits remote attackers to disable cellular connectivity or force device crashes through a specially constructed SMS. The flaw operates silently, processing the message before it reaches the user's inbox and leaving no trace of what triggered the failure.

The vulnerability affects how Android validates header-length data in the WapPushOverSms.decodeWapPdu function. Attackers can send a malformed eight-byte WAP Push message to port 2948 that, when interpreted as a signed 32-bit integer, becomes -2147483648. This negative value causes Android's memory allocation to fail with a NegativeArraySizeException, crashing the com.android.phone process that manages all cellular operations.

The impact extends beyond a single crash. Researcher Mark Blah found that sending 20 malicious messages can trap devices in continuous reboot loops. On one Android 12 device tested, the phone rebooted into recovery mode every 90 seconds, ultimately requiring a factory reset to restore functionality. Carriers attempting to redeliver the messages or Android's own processing of stored messages can trigger additional crashes.

Google addressed the flaw in its October 2026 Android security updates for versions 14 through 17, implementing a fix titled "Fix remote DoS in decodeWapPdu" that catches exceptions during message processing and removes malicious messages from the SMS database. However, the patch does not appear in Google's official October security bulletin, and devices running Android 12 and 13 remain unpatched and vulnerable.

Removing malicious messages from an already-compromised device is possible through Android Debug Bridge (ADB), a method discovered by GitHub contributor Sakis, but this approach demands technical expertise and access to a computer. Blah has published a proof-of-concept tool capable of delivering the malicious messages from another Android device.

Installation of security updates occurs automatically on supported devices, though timing depends on device manufacturers and carriers, and a reboot may be necessary. With a working exploit now in circulation, Android users should prioritize installing the latest available security patches immediately.