Android ‘SMS of Death’ zero-click flaw lets attackers crash phones remotely

How the exploit works

Security researcher Mark Blah identified a critical-severity vulnerability in Android, tracked as CVE-2026-58882 and nicknamed the 'SMS of Death.' The flaw stems from improper validation of a header-length value in Android’s WapPushOverSms.decodeWapPdu function. A malformed eight-byte WAP Push message sent to port 2948 triggers a NegativeArraySizeException, crashing the com.android.phone process.

The crash disrupts core cellular functions, including calls, mobile connectivity, and emergency services. Since Android processes messages before they reach the inbox, victims may not see the SMS, and some carriers may attempt to redeliver it, worsening the impact.

Device impact and recovery

Sending 20 or more malicious messages can force an Android device into a reboot loop or, on Android 12, into recovery mode. In recovery mode, users may need to perform a factory reset to restore functionality, risking data loss.

A GitHub contributor demonstrated that the malicious message can be removed using Android Debug Bridge (ADB), but this requires technical expertise most users lack.

Google’s patch and limitations

Google addressed the vulnerability in its October 2026 Android security updates, patching versions 14 through 17. The fix, titled 'Fix remote DoS in decodeWapPdu,' prevents crashes by catching exceptions triggered by malformed messages and removes malicious SMS entries from the database to avoid repeat crashes.

Devices past their end-of-life date, including older Android versions, will not receive patches and remain vulnerable. Users of devices from Samsung, Xiaomi, Motorola, and OnePlus may need to wait for manufacturer-specific updates.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

For founders and operators, this vulnerability highlights the fragility of mobile security, especially for devices running outdated software. Startups building products reliant on Android’s telephony stack should audit their own apps for similar input-validation gaps. Enterprise operators using older Android devices for business-critical tasks may face unexpected downtime or data loss if devices are targeted. The exploit also underscores the risks of zero-click attacks, which bypass user interaction entirely—a growing concern for security teams.

Related on Lazyfounder

• Google
• Samsung
• More technology news