The ‘SMS of Death’ Can Crash an Android Phone With One Text
A flaw in Android's handling of an old carrier message type can knock a phone off the network without the owner ever seeing a message. Phones on Android 14 and later have a fix in reach. Phones on Android 12 and 13 do not.
A single text message can crash an Android phone. The owner does not have to open it, tap a link, or install anything. The message never shows up in the inbox at all.
Security researcher Mark Blaszczyk published the flaw and a working demonstration on October 29. He calls it the SMS of Death. It is tracked as CVE-2026-58882 and rated Critical in later coverage of the disclosure.
The flaw sits in how Android handles WAP Push messages. That is an old carrier format, still used behind the scenes for things like multimedia-message notifications and carrier settings. Android processes this kind of data message before it ever reaches the messaging app.
The malformed message is eight bytes long. In Blaszczyk's analysis, Android reads a header-length value in the message and converts it to a signed 32-bit integer without checking its range. The value flips negative. Android then tries to allocate memory of that negative size, and the phone process crashes.
That process, com.android.phone, runs calls and cellular service. When it dies, any call in progress drops, including a call to emergency services. Service usually returns within seconds as the process restarts. That is the single-message effect, and it is bad enough on its own.
Repeated messages can trap the phone
The worse case comes from repetition. Messages that stay queued get processed again after a restart, and the crash repeats. Reporting on the disclosure says about 20 malformed messages can push a phone into a cycle of reboots into recovery mode. On one Android 12 device in the researcher's tests, the phone rebooted into recovery about every 90 seconds and had to be factory reset. A cleanup method using Android Debug Bridge, which needs a computer and some technical skill, was also described.
What the flaw does not do matters too. It is a denial of service. Nothing in the disclosure suggests it steals data or hands an attacker control of the phone. As of October 31, reporting found no confirmed attacks on real phones. The 100 percent reproduction figure in the coverage is the researcher's own test result, not evidence of a live attack wave.
Who has a fix, and who does not
Blaszczyk reported the flaw to Google on May 5. Google first classified it as a non-security issue. Android's own code records show a Google engineer wrote a fix on June 15, and the fix reached the Android Open Source Project in August. The fix catches the crash and deletes the offending message from the phone's raw message table, so it cannot keep crashing the phone after a restart.
According to the researcher's write-up, the fix shipped in the October 2026 security updates for Android 14, 15, 16 and 17. Android 12 and 13 did not receive it. Those phones run the same faulty code and, on the current reporting, stay exposed.
The patch picture is messier than that summary. The flaw does not appear in Google's October security bulletin. Android Authority, citing the privacy-focused Android distribution GrapheneOS, reports the fix appears to be slated for the November bulletin instead, after reaching phone makers through July security previews. Google has not publicly explained the discrepancy, and Android Authority reported it had no response from Google when it published.
For owners, that leaves a practical rule rather than a clean one. On Android 14 or later, install the latest security update available for the phone, then check again when the November bulletin lands. An October patch date is a good sign, but on the current reporting it is not yet a guarantee that this specific fix is on the phone. The patch level is listed under Settings, then About phone, then Android version, on most phones.
There is no setting that blocks WAP Push messages, because they are processed before they reach the inbox. There is no link to avoid, no sender to block, and no app to uninstall. For phones stuck on Android 12 or 13, there is no patch to install at all. Those are the phones with the least protection from a message their owners will never see.
