CVE-2026-58882
In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- First covered by RedTeamDaily
- Published by NVD
- Last updated by NVD
Coverage
Public proof-of-concept exploit crashes unpatched Android phones via a crafted text message
Security researcher Mark Blaszczyk has released a proof-of-concept for a zero-click denial-of-service flaw in Android, dubbed SMS of Death. A single crafted WAP Push message, sent on port 2948, crashes the com.android.phone process and can interrupt active calls, including emergency calls. The researcher reports reproducing it on Google Pixel 9 and Samsung Galaxy devices, with the vulnerable code present from Android 12 to Android 17.
Sources: NVD and CISA known exploited vulnerabilities catalogue.