A serious security vulnerability on the Android operating system has just been publicly announced, called "SMS of Death". This vulnerability allows a remote attacker to interrupt mobile connections and interrupt ongoing calls (including emergency calls) simply by sending a special SMS message, without the victim needing to perform any action.

The vulnerability is tracked as CVE-2026-58882. According to security researcher Mark Blaszczyk (also known as Mark B), the problem lies in the WAP Push message handling function in Android's WapPushOverSms component. When a formatted WAP Push message is received (only 8 bytes long), the system tries to allocate memory with a negative value, resulting in an error.

NegativeArraySizeException and causes the com.android.phone process to crash. This process is responsible for managing calls and mobile connections, so stopping it will cause the signal to be temporarily lost and calls in progress to be interrupted suddenly.

The notable point is that the malicious message does not appear in the SMS inbox, nor does it appear as a notification. Android processes it at the system level before sending it to the mailbox, leaving users virtually unaware of the reason the phone lost signal or the call was cut off. If an attacker sends about 20 such messages, some devices may fall into a continuous reboot loop, even requiring a factory reset or using an ADB tool to recover.

Timeline to date.

Regarding the timeline, the researcher reported the vulnerability to Google from May 5, 2026 through the Android & Devices Vulnerability Reward Program. On June 15, Google engineers wrote a commit to fix the error called "Fix remote DoS in decodeWapPdu".

Source links:

• Commit to fix errors on AOSP: Commit link, Link to view diff (code changes)
• Google's official security bulletin (October 2026)
• Original page of the researcher reporting the bug

The patch was later included in the October 2026 security updates for Android 14 to Android 17. However, the vulnerability was not listed in Google's official October security bulletin. Devices running Android 12 and 13 are still vulnerable because the security update support period has expired.

On October 29, 2026, Mark Blaszczyk decided to publish technical details and proof-of-concept code after Google moved to classify this as a "non-security" issue. The publication increases the risk, as anyone with the victim's phone number can attempt an attack.

The severity of the vulnerability is rated at Critical. While it doesn't allow device hijacking or data theft, the ability to disconnect emergency calls and make the phone temporarily unusable makes it worrisome, especially for users who are still using old Android devices.

For now, users of Android 14 and above should check for and install the latest security updates as soon as possible. For devices running Android 12 or 13, there is almost no official way to patch. In case of impact, users can try deleting malicious messages using ADB or performing a factory reset, although this is not a convenient solution.

Although Android 12, 13, 14 are relatively old, the number of devices using these Android versions is quite large, so the scope of influence is not small.

Advertisement

If you want to avoid this security error, you can do the following:

• Android 12 or 13: there is no official patch from Google, if the device supports it, update to a newer Android.
• Android 14 to 17 can update to the October 2026 update.

The “SMS of Death” vulnerability once again shows the risks coming from legacy message handling components on Android. The fact that older devices are no longer supported with updates leaves millions of users still within the reach of similar attacks in the future.