November 2, 2026
A security researcher published an experimental exploit code for a serious vulnerability in the Android operating system, bearing the code (CVE-2026-58882) and called “SMS of Death,” which allows attackers to disrupt cellular communications service or drop phones remotely by sending a text message specifically designed for this purpose, according to the Bleeping Computer website.
The vulnerability is classified as “no-click denial of service,” as it has the ability to interrupt ongoing calls, including emergency calls, without any significant interaction from the victim. The seriousness of the vulnerability lies in the fact that the Android system processes the message before it reaches the inbox, which prevents any indication from appearing to the user explaining the reason for the malfunction of his phone.
In the technical details published by researcher Mark Blah, the vulnerability is due to a defect in verifying the header length value within one of the “WAP Push” message processing functions, where a distorted value is converted to a negative number that causes the (com.android.phone) process responsible for cellular functions to collapse, and thus leads to disconnection from the network and calls.
The researcher explained that the attack may cause repeated collapses. Either as a result of telecom companies trying to resend malicious messages, or while Android is processing messages stored on the phone. Tests showed that sending 20 malicious messages led to the phones entering a continuous reboot loop, as a device running “Android 12” rebooted itself in recovery mode approximately every 90 seconds, which required a factory reset. Although a contributor on the GitHub platform has found a way to delete these messages via the ADB tool, the solution requires advanced technical knowledge and the use of a computer.
In terms of treatment, researcher Blah reported that Google had issued a patch for the vulnerability as part of the October 2026 security updates for versions from “Android 14” to “Android 17,” but the vulnerability was not officially included in the security bulletin for the aforementioned month. On the other hand, old devices running the “Android 12” and “13” systems are still at risk because they have not received the necessary fix.
Google’s fix works to prevent crashes by catching exceptions resulting from processing malformed messages, as well as automatically deleting malicious messages from the message database to avoid recurring crashes.
In light of the availability of working exploit code, Android users are strongly advised to install the latest security updates as soon as they are available, noting that the arrival of these updates remains dependent on the device manufacturer and telecom operator, and completing the installation may require restarting the phone.
