Android “SMS of Death”: a zero-click WAP push SMS crashes the phone process and drops calls (CVE-2026-58882 per BleepingComputer)

What happened

Researcher Mark Blah found that Android’s WAP push handling, in WapPushOverSms.decodeWapPdu() in the telephony framework, reads a header length from the message, casts it from long to int without a range check, and uses it as an array size. A crafted value makes the size negative. That throws an uncaught NegativeArraySizeException on the telephony main thread and kills com.android.phone (SMS of Death).

The message arrives as a data SMS, so the victim sees nothing and no sender number is shown (SMS of Death). The effects (BleepingComputer):

• Cellular service drops and calls in progress end, including emergency calls.
• Carrier redelivery, or Android reprocessing stored copies, repeats the crash. The researcher saw outages on and off for up to a week from one message (SMS of Death).
• In testing, 20 messages caused reboot loops. One Android 12 device rebooted into recovery about every 90 seconds and needed a factory reset.

The researcher reproduced it on Android 12 to 16, on a Pixel 9 and several Samsung Galaxy devices (SMS of Death).

The fix. The researcher reported it to Google’s Android VRP on 5 May 2026. Google’s commit 735d967, “Fix remote DoS in decodeWapPdu”, was written on 15 June. It catches the RuntimeException during WAP push decoding, logs a warning, and deletes the bad message from the raw SMS database so it cannot crash the phone again on redelivery or boot (AOSP). The researcher notes it does not add the bounds check he suggested; it swallows the crash instead (SMS of Death). It shipped in the October 2026 security update for Android 14 to 17. Android 12 and 13 run the same code and did not get it (BleepingComputer).

The issue is not listed in Google’s October 2026 Android security bulletin, and Google has published no severity (BleepingComputer). BleepingComputer gives the ID CVE-2026-58882, but the CVE record was not published as of 2 November (CVE API).

The researcher disclosed it on 29 October and published a proof-of-concept Android app at github.com/MarkBlah/smsofdeath (SMS of Death). No use in real attacks has been reported.

Am I affected?

A phone is exposed if it runs Android 12 or 13 at any patch level, or Android 14 to 17 below the October 2026 patch level (SMS of Death). Check in Settings, About phone, Android version, or over ADB:

adb shell getprop ro.build.version.release         # Android version
adb shell getprop ro.build.version.security_patch  # must be 2026-10-xx or later

In an MDM, report on OS version and security patch level and filter for anything below 2026-10, plus every Android 12 and 13 device.

To check whether a phone has already been hit, look for the exception the crash produces:

adb logcat -b crash -d | grep -iE 'NegativeArraySizeException|com.android.phone'

Users will describe it as the phone losing signal for a second or two, calls dropping for no reason, or reboot loops.

What to do now

1. Require the 2026-10 security patch level on Android 14 to 17. Availability depends on the manufacturer and carrier, and the phone may need a restart to apply it (BleepingComputer).
2. Flag Android 12 and 13 devices as permanently exposed and plan their replacement, starting with phones used by on-call staff, field workers and anyone who relies on the phone for emergency calls.
3. If a phone is stuck in a crash or reboot loop, do not pick “wipe data” at the recovery prompt. The researcher describes an ADB recovery, credited to @sakisdog, that deletes the queued messages in a short window after boot. The last resort clears all SMS, MMS and APN settings (SMS of Death).
4. If you build Android images from AOSP, cherry-pick commit 735d9672603fa206c4b43cb668c1aa273db70b97 into frameworks/opt/telephony (AOSP).

Sources

• AOSP commit 735d967: Fix remote DoS in decodeWapPdu
• SMS of Death: researcher write-up
• BleepingComputer: new Android SMS of Death exploit can remotely crash unpatched phones
• CVE API lookup for CVE-2026-58882 (not published)