Android SMS of Death Bug Crashes Phones With One Silent Text

Hakkı ALKAN

October 30, 2026

A flaw dubbed SMS of Death lets an attacker crash the phone service on Android devices with a single invisible text message, dropping active calls, including emergency calls, without the victim doing anything. Security researcher Mark Blaszczyk published the details and a working proof of concept on October 29, 2026. The bug is tracked as CVE-2026-58882 with a Critical rating, and devices on the October 2026 security patch or later are protected.

How the SMS of Death Attack Works

The attack abuses the way Android handles WAP Push messages, a type of data SMS used for things like carrier configuration. According to Blaszczyk’s technical write-up, a malformed five-byte header in the message makes Android’s telephony framework try to create an array with a negative size. That throws an unhandled error and kills com.android.phone, the system process that runs calls and mobile service.

The message never shows up in the Messages app, and the sender’s number is never displayed. All an attacker needs is the target’s phone number. Each message causes one to two seconds without service while the process restarts, and any call in progress is cut off.

Why It Can Leave a Phone Unusable

The crash does not stop after one hit. Because the phone never confirms delivery, carriers keep resending the message, and Android stores it in a pending queue that is retried on every boot. In Blaszczyk’s testing, a single message caused intermittent outages for up to a week, and around 20 messages made a device unusable for an extended period.

In the worst case the phone falls into a reboot loop and lands on the recovery screen roughly every 90 seconds. A community fix posted alongside the disclosure clears the poisoned messages over ADB (Android Debug Bridge) without a factory reset, but that requires a computer and some technical skill. For most people, the realistic way out is wiping the phone.

The researcher reproduced the attack on a Pixel 9 running April 2026 firmware and on several Samsung Galaxy S and A series models, with a 100% success rate, Android Authority reports.

Which Android Versions Are Affected?

The vulnerable code sits in Android’s core telephony framework. Crashes were reproduced on Android 12 through Android 16. Google’s fix was released for Android 14 through Android 17, so phones stuck on Android 12 or 13, which are outside the security update window, will not get it, as Cybernews also notes.

Google Had a Fix Months Ago

Blaszczyk says he reported the bug to Google’s Android and Devices Vulnerability Reward Program on May 5, and that the report was repeatedly treated as a non-security issue, which led him to go public. Android’s code history tells a different story. An Android engineer wrote commit 735d967, titled “Fix remote DoS in decodeWapPdu,” on June 15. Rather than adding the bounds check the researcher proposed, it catches the error and deletes the bad message so it cannot crash the phone again.

According to GrapheneOS, device makers received the patch through Google’s security preview program in mid-July, GrapheneOS shipped it to its users that month, and CVE-2026-58882 is listed as Critical in the upcoming November 2026 Android Security Bulletin. Google has not publicly explained the mismatch between the researcher’s account and its own timeline.

What You Should Do

• Open Settings, then Security and privacy, and check your Android security update date. October 2026 or later means you are covered.
• If an update is waiting, install it now. Pixel owners should already have it; Samsung and other brands roll patches out on their own schedules.
• If your phone runs Android 13 or older and no longer gets security updates, it stays exposed. That is a good reason to consider a supported device.

The bug lands as Google pushes new builds such as Android 17 QPR3 Beta 3, and it is a reminder of why monthly patches matter. For background on how Google and Samsung ship fixes, see our coverage of earlier critical Android patches and Samsung’s July 2026 Galaxy security update.