A security researcher has published a proof-of-concept exploit for an Android flaw that can knock phones offline and drop calls, including calls to emergency services, with a single text message and no action from the user. The vulnerability is tracked as CVE-2026-58882 and has been nicknamed "SMS of Death." The researcher, Mark Blah, released the exploit along with a technical analysis of the flaw.

The bug involves improper validation of a header-length value in Android's WapPushOverSms.decodeWapPdu function. An attacker sends a malformed eight-byte WAP Push message, sent as a data SMS to port 2948, and Android converts the value into a signed 32-bit integer without a bounds check, producing -2147483648. When Android tries to allocate memory using that negative value, it throws a NegativeArraySizeException that crashes the com.android.phone process. Because that process handles cellular functions, the crash cuts mobile connectivity and disconnects ongoing calls.

Android processes the message before it reaches the SMS inbox, so victims see no indication of what caused the crash. Blah said the attack can also cause repeated crashes when carriers redeliver the malicious messages or when Android processes messages already stored on the phone. In testing, sending 20 malicious messages could trap phones in reboot loops; one Android 12 device rebooted into recovery mode roughly every 90 seconds and needed a factory reset to recover.

According to Blah, Google patched the vulnerability in its October 2026 Android security updates for Android 14 through 17, but the flaw is not listed in Google's October security bulletin. Older Android 12 and 13 devices remain vulnerable because they did not receive the fix. Google's fix, titled "Fix remote DoS in decodeWapPdu," catches the exceptions triggered by the malformed messages and deletes the malicious messages from the SMS database to prevent repeated crashes.

A GitHub contributor named Sakis found a way to remove the malicious messages using Android Debug Bridge, though the process requires more advanced technical knowledge and access to a computer. Blah's proof-of-concept exploit can send the malicious messages from another Android device.

Android security updates generally install automatically on supported devices, but availability depends on the device manufacturer and carrier, and a restart may be required to complete installation. With a working exploit now public, Android users are advised to install the latest security updates.

More cybersecurity news from TechManNews.