GoKawiilResearcher publishes proof-of-concept for 'SMS of Death' Android flaw CVE-2026-58882
Security researcher Mark Blah released a working exploit for a zero-click Android vulnerability that lets attackers crash phones or disrupt cellular service by sending a single malformed eight-byte WAP Push message over SMS. The bug stems from unchecked header-length parsing in Android's WapPushOverSms.decodeWapPdu function, which triggers a crash in the com.android.phone process and can drop active calls, including emergency calls. Google patched the issue for Android 14 through 17 in its October 2026 update, though it wasn't listed in the public bulletin, leaving Android 12 and 13 devices unprotected.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the attack requires no user interaction and leaves no trace in the SMS inbox, victims may have no way to know why their phone crashed, which could complicate detection and response. The researcher's finding that repeated messages can trigger reboot loops suggests the flaw could be used for persistent harassment or to block emergency calls at critical moments, though no real-world exploitation has been reported. Older unpatched Android 12 and 13 devices remain exposed, highlighting a continuing gap in how quickly security fixes reach fragmented Android hardware.
- A zero-click exploit (CVE-2026-58882) can crash Android phones via a single malformed SMS/WAP Push message.
- Google patched Android 14–17 in October 2026, but Android 12 and 13 devices remain vulnerable and the flaw wasn't in the public bulletin.
- The attack can disrupt active calls, including emergency calls, and repeated messages may trigger reboot loops.
Source: bleepingcomputer.com, 2026-10-31
Published there as: “New Android SMS of Death exploit can remotely crash unpatched phones”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.