Android 'SMS of Death': one WAP Push text can crash phones; fix in 2026-10-01 patch
A researcher disclosed a zero-click bug that crashes Android's telephony process; Google's fix covers Android 14 to 17, not 12 and 13.
· 5 min read
Written by AI from the sources linked below. How we use AI
On this page
A researcher published details on 29 October 2026 of an Android flaw nicknamed "SMS of Death": a single specially built WAP Push text message can crash the phone's telephony process, cutting cellular service and ending calls, with no sign in the messaging app. Google's fix reached Android 14 to 17 in the October 2026 security update, but Android 12 and 13 are listed as not covered by it. Public proof-of-concept code is available, so the practical advice is to install the October update or later if your phone has one.
Key points
- The bug is in
WapPushOverSms.decodeWapPdu(): an unchecked conversion of a length value to a 32-bit integer gives a negative array size and an uncaughtNegativeArraySizeExceptionincom.android.phone. - The researcher, Mark Blah, says the fix covers Android 14 to 17 and does not reach Android 12 and 13, and that the bug was reported to Google's vulnerability reward programme on 5 May 2026.
- Google's patch (commit 735d967, authored 15 June 2026) catches the failure and deletes the triggering message; devices on patch level 2026-10-01 or later should be protected.
- BleepingComputer gives the flaw the identifier CVE-2026-58882, but the researcher's page lists no CVE and we could not find that identifier in Google's October bulletin, so treat it as unconfirmed.
- Phones that are already stuck in a crash loop may need an ADB-based clean-up; the researcher advises against choosing "wipe data".
What to do
- Who is affected: the researcher says Android 12 to 17 contain the code. The fix is for 14 to 17. Phones on Android 12 and 13 outside the update window have no listed fix.
- Fix: install the Android security update with patch level 2026-10-01 or later (Settings, About phone, Android security update). Google's bulletin, published 5 October 2026 and updated 8 October, says patch levels of 2026-10-01 or higher address the issues it lists. Timing depends on your phone maker and carrier.
- Workaround: none we can recommend for Android 12 and 13. The researcher describes an ADB-based recovery for a phone in a reboot loop, credited to a community contributor. It needs a computer and advanced steps. He advises against choosing "wipe data" at the recovery prompt.
- How to tell: repeated loss of signal, dropped calls or reboots with no visible message may point to this. We cannot say that every such symptom is this bug.
What happened
The researcher's page describes a WAP Push message sent as a data SMS that Android decodes in the telephony code before it ever reaches the inbox. A header-length value is turned into a signed integer without a bounds check, producing a negative number. Using it to allocate memory throws a NegativeArraySizeException, nobody catches it, and the com.android.phone process dies. The author calls it a "Destructive Remote DoS" and reports a 100% reproduction rate across several devices.
The effects he reports: active calls drop, including emergency calls; each message costs one to two seconds without service; and because carriers may redeliver the message and the malformed message is retried at boot, the phone can fall into a persistent loop. BleepingComputer reports that roughly 20 such messages put phones into reboot loops, and that one Android 12 phone rebooted into recovery about every 90 seconds and needed a factory reset. Those are the researcher's and BleepingComputer's figures; we did not test them.
Background
The timeline, from the researcher's page:
- 5 May 2026: reported to the Android and Devices vulnerability reward programme.
- 15 June 2026: a Google engineer authors the fix commit.
- October 2026: the fix ships in the monthly Android update for Android 14 to 17.
- 29 October 2026: public disclosure, with a proof-of-concept on GitHub.
Google's approach differed from the researcher's suggestion. Rather than add the bounds check he proposed, the commit titled "Fix remote DoS in decodeWapPdu" widens the exception handling and deletes the message when decoding fails. The researcher says this stops both the crash and the boot loop.
The numbers
Days between the report and each milestone, calculated from the dates above (the October update is counted from the bulletin's publication on 5 October):
What it means
For most people with a recent phone the exposure is closed once the October update installs. The ones left out are owners of Android 12 and 13 devices, and anyone whose phone maker is slow with updates. Because the message is processed before the inbox, there is no app to uninstall and nothing to click, so a patch is the only real defence.
The emergency-call angle is the researcher's own argument: he suggests rules in Australia could lead carriers to block handsets that cannot reach emergency services. We have not verified that, and treat it as his analysis.
There is also a disclosure question. The gap from report to public disclosure was about six months (177 days). BleepingComputer notes the flaw is not listed in Google's October bulletin; we checked and found no entry for decodeWapPdu, the WAP Push flaw or CVE-2026-58882 in the 2026-10-01 bulletin. Entries we did find are for other framework and telephony denial-of-service bugs (CVE-2026-58865, CVE-2026-58834 and CVE-2026-58859), and we cannot say whether any of them is this one.
What we don't know yet
- Whether a CVE has been assigned. BleepingComputer names CVE-2026-58882; the researcher's page and Google's bulletin do not, as far as we could see.
- Whether Google will fix Android 12 and 13, which are outside the update window.
- Whether anyone has used the flaw outside testing. Neither source reports in-the-wild attacks.
- How carriers will filter such messages. A carrier-side block on the relevant port is a plausible mitigation but we have not seen one announced.
What to watch next
Watch for a CVE entry or a Google statement, for your phone maker's October or November update, and for carriers filtering these messages. If you run a device fleet, check the patch level of every Android 14 to 17 phone and plan for replacing or isolating older ones.
Sources
Written by
The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.
Read next
VOLTA infostealer: Talos says it asks Claude Opus 4.6 via OpenRouter what victims are worth
Cisco Talos found a Windows stealer that sends stolen data to an AI model to rank a victim's value, and falls back to other models if one refuses.
audiotale.net team6 min read
ChatGPT shared-link flaw let attacker code run in your session, Parameter says; OpenAI fixed it
Parameter says opening a malicious ChatGPT share link could run JavaScript as chatgpt.com and read private chats; OpenAI fixed it on 26 October and paid $5,000.
audiotale.net team6 min read
Chainalysis breach: attacker used "offensive agentic techniques", names and emails exposed
Chainalysis says an outside actor used AI-agent techniques to reach internal tools and customer user IDs, names, emails and role labels; it says investigation data and credentials were not accessed.
audiotale.net team5 min read