Android 'SMS of Death' (CVE-2026-58882): zero-click DoS, PoC public

A single malformed text message can crash the telephony process on an unpatched Android phone with no user interaction, dropping active calls — including emergency calls — and, on repeat, forcing a device into a reboot loop. The flaw, nicknamed "SMS of Death" and tracked as CVE-2026-58882, was disclosed with a working proof-of-concept on October 29 by researcher Mark B (handle @sourone), after a May 5 report to Google's Android & Devices VRP was handled as a non-security bug.

The bug

The defect is in WapPushOverSms.decodeWapPdu() in Android's telephony framework. Per the researcher's writeup, the function reads a WSP header-length field as a uintvar, casts the resulting long to int with no range check, then uses it as an array size (new byte[headerLength]). A crafted negative value throws an uncaught NegativeArraySizeException and crashes com.android.phone, the process that manages cellular functions. Android processes the WAP Push before it reaches the SMS inbox, so the victim sees nothing — a true zero-click.

The malformed messages land in Android's pending inbound queue (content://sms/raw) and are retried on each boot, which is what turns a one-off crash into a reboot loop. The researcher reports that 20 messages put a test Android 12 device into a loop requiring recovery.

What's affected

• Reported as affecting Android 12 through 17; reproduced from 12 through 16.
• Google's fix covers Android 14 through 17 — commit 735d967, titled "Fix remote DoS in decodeWapPdu," authored June 15 and shipped at the October 2026 patch level. It widens the caught exception and deletes the triggering message.
• Android 12 and 13 are outside the security-update window and do not receive the fix.

Note the disagreement on where the fix is documented: the researcher ties it to the October 2026 release, while heise and Android Authority report it was not listed in Google's published October bulletin and is expected in the November bulletin, rated Critical. As of disclosure, MITRE had not yet published the CVE record, so the NVD entry may be sparse or absent for now.

Exploitation status

No in-the-wild exploitation has been reported. What raises the urgency is that the PoC is public — the author published an Android APK and source on GitHub (Apache 2.0, flagged for authorized testing only) that sends the malicious messages from one Android device to another.

Action checklist

1. Apply the October 2026 (or later) security patch level. Check Settings → About phone → Android security update; a reboot may be needed to finish installation. Availability depends on your OEM and carrier.
2. If you're on Android 12 or 13, there is no fix — plan migration or device replacement; this is a terminal-support situation.
3. Recovering a looping device: the researcher documents removing the offending rows from content://sms/raw (WAP Push messages on the relevant destination port) via ADB in the short window after boot. pm clear com.android.providers.telephony is a last resort — it erases all SMS/MMS and APN settings. Do not choose "wipe data" at the recovery prompt.
4. Fleet owners: treat Android 12/13 handsets as exposed and prioritize their refresh; watch for the November Android Security Bulletin to confirm the CVE's official listing and severity.

Context

This is the same class of bug that gave Android its original 2009 "SMS of Death" (a malformed WAP Push crashing the phone app), re-emerging in the same code path 17 years later. The pattern — unchecked length fields in low-level message parsers reachable without user interaction — is exactly why telephony stacks remain a high-value target: no click, no app install, just a phone number.