Public proof-of-concept exploit crashes unpatched Android phones via a crafted text message
- Severity
- High
- Exploited
- Not known
- Sources
- 2
What happened
SMS of Death, tracked as CVE-2026-58882, is a remote zero-click DoS in the WapPushOverSms component (frameworks/opt/telephony). In decodeWapPdu(), a uintvar WSP header length is narrowed from 64-bit to a signed 32-bit int without range checking, so a 5-byte value such as 88 80 80 80 00 yields -2147483648 and an uncaught NegativeArraySizeException kills com.android.phone. The payload arrives as a WAP Push data SMS on port 2948 and can persist in the incoming queue, causing repeated crashes. Google has shipped a fix in the October 2026 security update for Android 14 to 17. Defenders should confirm patch levels and prioritise devices on Android 12 and 13, which may remain exposed.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Check the Android security patch level on your device and install the October 2026 security update if it is available.
- Treat devices on Android 12 or 13 as potentially exposed and check whether the manufacturer still provides updates.
- If a device keeps crashing after a message is received, use the Android Debug Bridge from a computer to clear the queued messages, as described in the article.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 3 updates
Who reported · 2 outlets
Who and what is in it
Companies
Products