An eight-byte SMS crashes unpatched Android phones and cuts off emergency calls

A researcher published a proof of concept for CVE-2026-58882, a zero-click denial-of-service that crashes Android’s phone process with a malformed eight-byte WAP Push message. Silently fixed for Android 14 through 17, the flaw leaves Android 12 and 13 exposed with no patch.