Android SMS of Death flaw can crash phones, Google fix rolling out

A security researcher has disclosed an Android vulnerability called “SMS of Death” that lets a crafted WAP Push message crash the phone process handling calls without any user interaction, according to researcher Mark Blaszczyk. The flaw, tracked as CVE-2026-58882, can disconnect active calls, including emergency calls, and repeated messages can leave a device in a reboot loop. Google developed a fix on June 15 and included it in October security updates for Android 14 through 17, but the patch has not reached all supported devices.

Blaszczyk said a single malformed WAP Push message crashes com.android.phone, ending any active call, and requires zero interaction from the recipient. “The victim does nothing. No tap, no open, no notification,” the researcher said. The exploit sends an eight-byte payload; five of those bytes represent a header length. Android converts that value, 2,147,483,648, to a 32-bit integer without checking range, causing it to overflow to -2,147,483,648 and trigger a fatal error. The malicious message never appears in the user’s SMS inbox, according to the researcher.

Because the phone does not acknowledge receipt, carriers can resend the message, and it stays queued for retry on every boot. Blaszczyk said about 20 such messages can leave a device nearly unusable and may cause a bootloop. Android’s Rescue Party then forces the phone into recovery mode after about 90 seconds, which can lead the user to perform a factory reset. Recovery without wiping may require connecting the phone to a computer and deleting queued messages through Android Debug Bridge, according to Cybernews.

The researcher said he tested the exploit on a Pixel 9 with April 2026 firmware and several Samsung Galaxy A-series phones, achieving a 100 percent reproduction rate. The flawed code has existed since Android 12, and Cybernews says the vulnerability affects Android 12 through 16; Android Authority notes devices no longer receiving security patches may stay vulnerable.

Blaszczyk first reported the flaw to Google on May 5, but he said Google repeatedly dismissed it as a non-security issue; he publicly disclosed it on October 29. Android’s code records show the fix was added on June 15, and GrapheneOS later said Google distributed it through July security previews and it is slated for November’s Android Security Bulletin. Google included the fix in October security updates for Android 14 through 17, according to Blaszczyk and Cybernews, but rollout to devices from Samsung, Xiaomi, OnePlus, Motorola and others depends on each manufacturer. Users should check Software Update or System Update in Settings and install the latest available security patch.