A malformed WAP Push text, CVE-2026-58882, crashes Android's phone service with no tap and no visible message, dropping calls and in some cases looping reboots. Google's October 2026 update fixes Android 14 to 17. Android 12 and 13 phones stay exposed, and exploit code is public.
Open Settings on your Android phone and check the security patch date. If it is older than October 2026, a stranger can knock your phone off the cellular network with one text you never see. The flaw, CVE-2026-58882, is nicknamed “SMS of Death,” and working exploit code went public this week.
What changed
Security researcher Mark Blah published the details on October 29 at smsofdeath.com, with proof-of-concept code on GitHub. BleepingComputer reported it on October 31.
- The attack: a malformed WAP Push message, sent as a data SMS, makes Android’s message decoder compute a negative size. The phone service (
com.android.phone) crashes. Android handles the message before it reaches your inbox, so nothing shows up and there is nothing to tap. - The damage: cellular service drops, including calls in progress and emergency calls, according to the researcher. Carriers can redeliver the message, so the crash can repeat. In the researcher’s tests, 20 messages caused reboot loops, and one Android 12 phone needed a factory reset, according to BleepingComputer.
- Tested phones: a Pixel 9 on April 2026 firmware and several Galaxy and Galaxy A models, all crashing every time, per the researcher.
- The fix: Google committed a patch titled “Fix remote DoS in decodeWapPdu” in June. It shipped in the October 2026 security update for Android 14 through 17. It catches the error and deletes the bad message. BleepingComputer notes the CVE does not appear in Google’s October bulletin.
- Not fixed: Android 12 and 13. Both are outside Google’s security-update window, so the researcher says they get no patch.
The researcher reported the bug to Google on May 5. It is a denial-of-service flaw: it crashes the phone service and does not give an attacker access to your data.
What to do now
1. Check your patch level. On most phones it is under Settings > About phone > Android version > Android security update (Samsung: Settings > About phone > Software information). You want October 2026 or later.
2. If it is older, update now. Go to Settings > System > Software update (Samsung: Settings > Software update). Restart when asked. Updates arrive on the maker’s and carrier’s schedule, so a Pixel may get it before a carrier-locked Galaxy.
3. If your phone runs Android 12 or 13, plan a replacement. No fix is coming for those versions. For anyone who depends on a phone for client calls or on-call work, that is the deciding factor.
4. If a phone is already stuck in a reboot loop, do not pick “wipe data” in recovery. The researcher’s page describes a fix over ADB (a computer plus a USB cable) that deletes the queued messages. It takes some technical skill, so this is a job for IT.
Old Android work phones are now a call-reliability problem
Most phone bugs ask you to tap something. This one needs only your number, and the result is a phone that can’t make or hold a call. If your team hands out Android phones, check every device’s patch date this week and retire anything stuck on Android 12 or 13. The device is cheap to replace. A dropped call with a client, or a phone that can’t reach emergency services, is not. When you buy, pick models whose makers promise long security support, and confirm patches actually land: Google’s own fix reached the code in June and phones in October.