New Android SMS of Death exploit can remotely crash unpatched phones
A zero-click security vulnerability tracked as CVE-2026-58882 allows threat actors to remotely crash unpatched Android smartphones using a malformed text message. The zero-click attack bypasses standard message filters and can disconnect mobile networks or trap victims in reboot loops, potentially impacting emergency calls. While recent system updates address the flaw for newer operating system versions, older software builds may not receive a patch, leaving certain devices vulnerable to service disruptions.
Listen to Live Briefing
Real-time synthesized voice briefing · Live Feeds Desk
- ✓ A vulnerability in the WapPushOverSms telephony code allows a malformed WAP push text to crash the com.android.phone application.
- ✓ CVE-2026-58882 enables attackers to remotely crash unpatched Android phones via an SMS message without user interaction.
- ✓ The exploit can disconnect Android phones from the mobile network and disrupt cellular connectivity.
What changed
Security analysts published details regarding an SMS of Death exploit that targets Android telephony code.
Live updates
-
Android SMS of Death Exploit Remotely Crashes Unpatched Phones
A zero-click security vulnerability tracked as CVE-2026-58882 allows threat actors to remotely crash unpatched Android smartphones using a malformed text message. The zero-click attack bypasses standard message filters and can disconnect mobile networks or trap victims in reboot loops, potentially impacting emergency calls. While recent system updates address the flaw for newer operating system versions, older software builds may not receive a patch, leaving certain devices vulnerable to service disruptions.
Why it matters
Security researchers discovered that a flaw in the WapPushOverSms telephony code turns an out-of-range header length into a negative array size. This error crashes the com.android.phone application without requiring any interaction from the device owner. The vulnerability highlights ongoing risks in mobile network processing and unpatched legacy software.
What is confirmed
- A vulnerability in the WapPushOverSms telephony code allows a malformed WAP push text to crash the com.android.phone application.
- CVE-2026-58882 enables attackers to remotely crash unpatched Android phones via an SMS message without user interaction.
- The exploit can disconnect Android phones from the mobile network and disrupt cellular connectivity.
Still unconfirmed
- Android 12 and 13 will not receive a fix for the SMS of Death vulnerability.
- The zero-click attack can trap victims in a reboot loop until a factory reset is performed.
What to watch next
- Deployment of security patches by device manufacturers for older Android versions
- Further technical analysis regarding the scope of affected software builds
confidence 90%Sources used for this update (22)
- www.nytimes.com — The New York Times - Breaking News, US News, World News and Videos
- www.cnn.com — Breaking News, Latest News and Videos | CNN
- www.nbcnews.com — NBC News - Breaking Headlines and Video Reports on World, U.S....
- www.foxnews.com — Fox News - Breaking News Updates | Latest News Headlines | Photos...
- www.bbc.com — BBC News - Breaking news, video and the latest top stories from...
- www.techradar.com — TechRadar | the technology experts
- www.bbc.com — BBC Home - Breaking News, World News, US News, Sports, Business...
- news.google.com — Google News
- www.bleepingcomputer.com — Retail giant Ahold Delhaize takes systems offline after cyberattack - BleepingComputer
- cashwalklabs.io — GM will switch to Nasdaq from the NYSE on Nov. 17
- BleepingComputer — New Android SMS of Death exploit can remotely crash unpatched phones
- PhoneArena — A simple text message can instantly ruin your phone — here’s how to stop it
Community Sentiment: How do you assess this situation?
Voice your perspective · Real-time aggregated sentiment from the Live Feeds community