A single text message that never appears in the inbox can crash the part of an Android phone that handles calls, according to a researcher who has now published a working exploit. The flaw, nicknamed SMS of Death and tracked as CVE-2026-58882, has already been patched by Google, but a public exploit raises the stakes for phones that have not yet received the update.
Security researcher Mark Blaszczyk disclosed the bug on Thursday, October 29, according to heise. Reports describe it as a zero-click attack, meaning the owner does not have to open or even see the message for it to work.
One technical analysis says the trigger is a malformed eight-byte WAP Push message, sent as a data SMS to port 2948, that breaks the WapPushOverSms.decodeWapPdu routine in Android’s telephony framework. WAP Push is a legacy messaging mechanism, and the message is handled before it reaches the inbox, which is why victims see nothing that explains what went wrong.
The researcher’s SMS of Death technical write-up documents crashes of the telephony process, dropped calls including emergency calls, and persistent disruption when malformed messages remain queued. The reported effects concern denial of service, rather than evidence of stolen personal data.
BleepingComputer reported that the exploit was released for a recently patched vulnerability. Google describes its monthly fixes in its Android Security Bulletins, and whether a given phone has the fix depends on its Android version, its manufacturer and its carrier. The safest step for owners is to install the latest system update as soon as one is offered.
Several questions are still open. The reports reviewed here describe the affected and patched Android versions in different ways, and this article has not confirmed which phones are protected today. The distinction between an Android version upgrade and continuing security support also appears in The Eastern Herald’s coverage of LineageOS 24 and older-device security updates; that coverage does not establish protection against this particular flaw. Owners of older devices should check their manufacturer’s update notes, because a public exploit makes an unpatched phone an easier target than it was before disclosure.
