New Android SMS of Death exploit can remotely crash unpatched phones

A security researcher released a proof-of-concept exploit for the Android vulnerability CVE-2026-58882, dubbed “SMS of Death,” that can remotely crash phones by sending a malformed eight-byte WAP Push message (01 06 88 80 80 80 00 BE) to port 2948. The zero-click denial-of-service flaw occurs in Android’s WapPushOverSms.decodeWapPdu function, where an unchecked header-length value translates to –2147483648, causing a NegativeArraySizeException that crashes the com.android.phone process and disrupts cellular service, including emergency calls. Google patched the issue in its October 2026 security updates for Android 14-17, but the fix is absent from the October bulletin and Android 12-13 devices remain vulnerable. Testing showed 20 malicious messages could trigger reboot loops, with one Android 12 device rebooting every 90 seconds. A GitHub contributor named Sakis found a way to remove the messages via ADB, though it requires technical expertise. ¹