Other cyber events · Developing
One hidden text message can crash an Android phone. Check your update
A hidden data message can crash an Android phone and end your calls. The October update fixes it. Check your phone.
What happened
A researcher found a way to crash an Android phone with one text message. The flaw carries the number CVE-2026-58882.
The message is a special data message, a WAP Push. Your phone handles it before it reaches your inbox.
You do not see the message. Your phone does not show the sender's number.
The crash stops the phone service. Active calls end, including calls to emergency services.
The phone service returns after a short pause. But about 20 messages can leave a phone unusable.
The phone company sends the message again when it gets no reply. So the crash can continue for days.
In one test, a phone restarted until it needed a full erase. A helper with a computer can clear the bad message without the erase.
The researcher reported the flaw to Google on May 5, 2026. Google's fix arrived with the October 2026 Android update.
Sources: SMS of Death: zero-click Android telephony DoS; Fix remote DoS in decodeWapPdu (the Android fix commit); New Android SMS of Death exploit can remotely crash unpatched phones
Who’s affected
This report concerns people who use an Android phone.
Phones with Android 12 through 17 ran the affected code. Tests reproduced the crash on Android 12 through 16.
The fix reached Android 14, 15, 16, and 17 in the October 2026 update.
Android 12 and 13 run the same code. Google has not released a fix for these versions.
The flaw lives in Android's phone software. iPhones do not run that software.
The flaw is not a bug in your phone company's network. The message arrives as a normal text.
Sources: SMS of Death: zero-click Android telephony DoS; New Android SMS of Death exploit can remotely crash unpatched phones
What to do
- Open Settings, then System, then System update. Install any update your phone shows.
- After the update, restart the phone.
- Open Settings and find the security update page. The Android security date needs to say October 1, 2026 or later.
- If your phone offers automatic updates, turn them on.
- If your phone restarts every few minutes, do not erase it yet. Ask your carrier or a helper with computer experience for help.
- If you use Android 12 or 13, check your phone maker's update page. Some makers add their own fixes.
- If no update exists for an old phone, plan to replace it. Old phones stop receiving security fixes.
Sources: SMS of Death: zero-click Android telephony DoS; New Android SMS of Death exploit can remotely crash unpatched phones
What we do not know yet
Google's October update fixed the flaw, and its fix is public in Android's code. BleepingComputer reports that the flaw is missing from Google's public October bulletin.
The researcher and BleepingComputer report no attack on a real person. The proof-of-concept worked only in the researcher's tests.
We do not know whether phone makers add their own fix for Android 12 and 13.
Tests did not cover Android 17. Google released the fix for it anyway.
Sources: Fix remote DoS in decodeWapPdu (the Android fix commit); New Android SMS of Death exploit can remotely crash unpatched phones
Guides for your next step
Sources
- SMS of Death: zero-click Android telephony DoS
Mark B (researcher write-up)
- MarkBlah/smsofdeath: WAP Push remote phone crash proof-of-concept
GitHub
- Fix remote DoS in decodeWapPdu (the Android fix commit)
Android Open Source Project
- New Android SMS of Death exploit can remotely crash unpatched phones
BleepingComputer
- CVE-2026-58882 incident summary
pwn.watch