New Android SMS of Death Exploit Can Remotely Crash Unpatched Phones

A newly disclosed Android security vulnerability could allow attackers to remotely crash smartphones and disrupt cellular connectivity simply by sending a specially crafted text message.

The vulnerability, tracked as CVE-2026-58882 and nicknamed SMS of Death, was demonstrated by security researcher Mark Blah through a proof-of-concept exploit.

The attack does not require victims to open a message, click a link, or interact with their devices. Instead, Android processes the specially crafted message before it reaches the SMS inbox, potentially causing the phone’s cellular system to crash.

One of the most concerning aspects is that the exploit can interrupt ongoing phone calls, including emergency calls. Victims may receive no visible indication explaining why their devices suddenly lose connectivity.

The vulnerability results from improper validation of a header-length value in Android’s WAP Push message-processing function. When the system processes the manipulated value incorrectly, it can trigger a software exception that crashes the com.android.phone process.

Researchers also demonstrated that repeated malicious messages could cause continuous crashes and, under certain conditions, push affected devices into reboot loops.

During testing, one Android 12 device repeatedly entered recovery mode, requiring a factory reset to restore normal operation.

Google reportedly addressed the vulnerability through its October 2026 security updates for Android 14 through Android 17. However, Android 12 and Android 13 devices remain vulnerable because they did not receive the reported fix.

Users should install all available security updates and check whether their device manufacturers have released additional patches.

The discovery highlights the risks associated with mobile messaging systems and demonstrates how a simple text message can potentially disrupt essential smartphone functions.