A single malformed text message can knock an unpatched Android phone off its cellular network, and in the worst case trap it in a reboot loop. That is the short version of "SMS of Death", a denial-of-service flaw tracked as CVE-2026-58882 that has gone from a quiet fix to a public exploit in the past few days.
We couldn't check the researcher's original technical write-up or Google's patch directly, so every detail below is attributed to the two outlets that reported it: BleepingComputer and Digital Trends.
What the flaw does
According to BleepingComputer, a security researcher has released a proof-of-concept exploit for the bug, which lets an attacker disrupt cellular service or crash a phone by sending a specially crafted text message. It is zero-click: the target doesn't have to open, tap or even see anything.
The mechanism, as BleepingComputer describes it, comes down to one unchecked number. The flaw sits in an Android function called WapPushOverSms.decodeWapPdu and is caused by improper validation of a header-length value. An attacker sends a malformed eight-byte WAP Push message as a data SMS to port 2948. Read as a signed 32-bit integer with no bounds check, that header value becomes negative. When Android then tries to allocate memory of a negative size, it throws a NegativeArraySizeException, and the com.android.phone process crashes.
That process is the one that manages cellular functions, so the outlet reports that the crash cuts mobile connectivity and drops calls in progress, including calls to emergency services. And because Android processes the message before it ever reaches the SMS inbox, the victim sees nothing that explains what just happened.
Digital Trends adds that the researcher notified Google in May, published the findings and a working demonstration on October 29, and reproduced the attack on Google Pixel and Samsung Galaxy phones. Its point is that exposure depends on the Android version and whether the patch is installed, not on the brand of phone.
Why one message can become many crashes
The crash isn't always a one-off. BleepingComputer reports that the phone can crash repeatedly when a carrier tries to redeliver the malicious message, or when Android reprocesses messages already stored on the device. In the researcher's testing, sending 20 malicious messages was enough to leave phones stuck in reboot loops. On one Android 12 device, the phone rebooted into recovery mode roughly every 90 seconds, and a factory reset was needed to recover.
There is a less destructive way out. BleepingComputer says a GitHub contributor named Sakis found a method to remove the malicious messages using Android Debug Bridge (ADB). It needs a computer and some technical confidence, which Digital Trends notes most users won't have.
Who is patched and who isn't
Both outlets report that, according to the researcher, Google fixed the flaw in its October 2026 Android security updates for Android 14 through 17. Both also note that the vulnerability isn't listed in Google's October security bulletin.
BleepingComputer reports that the fix, titled "Fix remote DoS in decodeWapPdu", catches the exceptions the malformed messages trigger and deletes the malicious messages from the SMS database, so they can't keep setting off crashes.
The gap is older phones. According to both outlets, Android 12 and 13 devices didn't receive the fix and remain vulnerable. Digital Trends frames it plainly: Google has a fix, but getting it onto every Android phone is another matter.
For perspective, Digital Trends stresses that this is a denial-of-service bug, not a way to steal passwords or personal data, and that there is no confirmed evidence of widespread attacks on Android users.
What to do
Install the latest security update. BleepingComputer notes that updates usually install automatically on supported devices, but availability depends on the manufacturer and carrier, and a restart may be needed to finish installing. Google's own help page explains how to check your Android security update level in Settings; the exact menu varies by manufacturer. With a working exploit now public, BleepingComputer says Android users are strongly advised to update.
Cole's take: The useful number here is the patch date, not the phone's age or brand. If your security update level reads October 2026 or later on Android 14 to 17, the researcher's account says this particular message shouldn't be able to take your phone down. If your phone is stuck on Android 12 or 13 with no more updates coming, this is a concrete reason to plan a replacement, because a fix that never ships doesn't protect anyone.
Reporting notes