New Android SMS of Death exploit can remotely crash unpatched phones

A researcher known as Mark Blah has released working exploit code for CVE-2026-58882, a zero-click Android bug nicknamed "SMS of Death" that lets an attacker crash a target phone's phone service simply by sending it a malicious text. The flaw sits in the WapPushOverSms.decodeWapPdu function, which fails to validate a header-length field in an eight-byte WAP Push message; when that value is misread as a negative 32-bit integer, Android throws an unhandled exception that kills the com.android.phone process, cutting off calls, including emergency calls, with no trace left in the SMS inbox. Google says it fixed the issue for Android 14 through 17 in its October 2026 security updates, though the CVE was omitted from the public bulletin, while Android 12 and 13 devices remain exposed since they never got the patch. Repeated bombardment with the crafted messages can even push some phones into endless reboot loops, in one case forcing a factory reset, so users on vulnerable or unpatched devices are urged to install the latest update as soon as it becomes available.