An eight-byte SMS crashes unpatched Android phones and cuts off emergency calls
A researcher published a proof of concept for CVE-2026-58882, a zero-click denial-of-service that crashes Android’s phone process with a malformed eight-byte WAP Push message. Silently fixed for Android 14 through 17, the flaw leaves Android 12 and 13 exposed with no patch.
October 31, 2026. Security researcher Mark Blah releases a proof of concept for CVE-2026-58882, nicknamed “SMS of Death”. October 2026. Google patches the flaw for Android 14 through 17 — without listing it in its security bulletin. Android 12 and 13 remain exposed. An eight-byte WAP Push message is enough to crash a phone’s telephony process and drop an emergency call in progress.
A decoding flaw in WAP Push handling
The vector is not an app but a legacy protocol: WAP Push, the operator-pushed messages used to provision a device. The bug sits in the WapPushOverSms.decodeWapPdu function, which fails to validate a header-length value before using it as an allocation size.
In practice, an attacker sends an eight-byte frame as a data SMS to port 2948:
# Malformed WAP Push frame (8 bytes), sent as a data SMS to port 2948
01 06 88 80 80 80 00 BETranslated into a signed 32-bit integer without a bounds check, the value becomes -2,147,483,648. Android then tries to allocate memory using that negative number, triggering a NegativeArraySizeException that kills com.android.phone — the process that manages cellular functions.
The result is a zero-click denial of service: no user interaction, and no visible message in the inbox, because Android processes the frame before it reaches the SMS inbox. The attack can drop a call in progress, including one to emergency services.
An invisible fix and two abandoned versions
The most confusing part is how the fix was distributed. According to the researcher, Google shipped a patch — titled “Fix remote DoS in decodeWapPdu” — in the October 2026 security updates for Android 14 through 17. The patch catches the exception and deletes the malicious messages from the SMS database to prevent repeated crashes.
But the flaw does not appear in Google’s October security bulletin. Security teams cannot tie this update to a CVE from the official documentation. Worse, Android 12 and Android 13 did not receive the fix at all: those versions stay vulnerable to a trivially produced frame.
That is the real problem. Enterprise fleets hold plenty of old devices, and Android’s update cadence depends on the manufacturer and carrier. With a public PoC, the window between disclosure and a real fix on every device stays open across two entire Android generations.
The flaw’s absence from the bulletin has a systemic consequence: patch transparency is a condition of security hygiene. When a fix is undocumented, teams cannot prioritize, audit or prove compliance. Here, only an independent researcher’s PoC made the CVE public. Regulators and CISOs increasingly treat documented patch levels as a compliance requirement, and a fix that never reaches a bulletin breaks that audit trail.
A legacy protocol turned back into an attack surface
CVE-2026-58882 is a reminder that SMS remains an unauthenticated channel, delivered by carrier infrastructure before any user-side barrier. WAP Push is its quietest extension: these messages, addressed to port 2948, are still used for carrier provisioning and MMS notifications. Android therefore has to process them in the background, with no interaction, by design.
That silent processing is what turns a validation defect into a zero-click denial of service. The message never appears in the messaging app: the victim has no trace, and automatic carrier redeliveries can re-trigger the crash indefinitely. Attacks on the signaling layer — SS7, Diameter — have exploited this idea for years; here there is no need to reach the network core: an eight-byte frame is enough.
From outage to factory reset
The impact goes beyond a simple reboot. During testing, the researcher found that sending about twenty malicious messages could trap some phones in a reboot loop. On an Android 12 device, the phone rebooted into recovery roughly every 90 seconds, forcing a factory reset to recover.
Carriers can redeliver the bad messages, and Android can reprocess messages already stored on the device: a single message becomes a source of repeated crashes. A GitHub contributor, Sakis, documented how to purge the offending messages over ADB (Android Debug Bridge), but that requires a USB connection, developer tooling and some skill — out of reach for a regular user.
The practical consequence is brutal: against a motivated attacker, a non-technical user can end up with an unusable phone, and the only documented way out without ADB is a full wipe.
A mere denial of service, but a real cost
CVE-2026-58882 is not remote code execution: it does not steal data, it does not encrypt a disk. It is a denial of service. Some will conclude it is harmless. That is a mistake, for three reasons. First, dropping an emergency call is, on its own, a potentially life-threatening harm. Second, the forced factory-reset remediation wipes the victim’s data — a real cost even without theft. Third, the cost of exploitation is near zero: an eight-byte frame, repeated twenty times, is enough. The effort-to-damage ratio is exceptionally unfavorable to the victim.
What to do
If you are on Android 14 through 17, install the October 2026 security update now. The PoC is public, the technical barrier is zero, and the flaw needs no interaction. Availability depends on the manufacturer and carrier, and a restart may be required to finish the install.
If you are on Android 12 or 13, there is no patch to apply. The flaw stays open. The available workarounds are imperfect — disabling WAP Push reception where the setting exists, or relying on carrier-side filtering — but the real signal is for decision-makers: an unpatched device is a trivial target, and this flaw makes that undeniable.
For fleet managers, two concrete actions: inventory devices still running Android 12 or 13 and accelerate their replacement, and check through your MDM that the October patch is actually deployed — because it is not in the bulletin, and nothing will flag it automatically.
Before any mass rollout, validate on a test device. Since the fix is not in the bulletin, the only proof it is applied is the patch level shown on the device. On a heterogeneous fleet, that check happens device by device, and an MDM that reports the patch version is the most reliable way to know whether the flaw is actually closed. Any Android 12 or 13 device still on the network is a standing liability until it is retired, because it will not receive this fix at all.
Verdict
If your devices run Android 14 through 17, patch today: the flaw is trivial to exploit, the PoC is public, and the fix already exists. If a fleet contains Android 12 or 13, treat them as permanently exposed: CVE-2026-58882 will likely never be fixed on those versions, and a single message can turn a phone into a brick. The lesson outlasts this flaw: when Google patches silently and the bulletin lists nothing, the only reliable defense is the update cycle — and devices that fall out of it are security debt, not savings. For individuals, the practical rule is the same: treat SMS as an untrusted input channel and keep the patch level current. The asymmetry is stark — eight bytes in, a factory reset out — and two Android generations have no way to close the hole.