New Android SMS of Death exploit can remotely crash unpatched phones

A zero-click denial-of-service vulnerability in Android, tracked as CVE-2026-58882 and dubbed 'SMS of Death', allows attackers to remotely crash unpatched phones or disrupt cellular service by sending a specially crafted SMS message. The flaw exists in the WapPushOverSms.decodeWapPdu function, which fails to validate a header-length value, leading to a negative array size allocation that crashes the com.android.phone process. Google patched the issue in October 2026 for Android 14 through 17, but older Android 12 and 13 devices remain vulnerable. A proof-of-concept exploit has been released, enabling malicious actors to send the crafted message to port 2948, potentially causing reboot loops and blocking emergency calls.

AI-extracted · verify before operational use