# New Android 'SMS of Death' Exploit Can Remotely Crash Unpatched Phones

*2026-11-01 15:00 UTC · Technology · 1 min read*

> A public exploit for CVE-2026-58882 lets a single eight-byte SMS crash the phone process on unpatched Android devices, with no user interaction.

A researcher has published a proof-of-concept exploit for CVE-2026-58882, a zero-click flaw that lets anyone crash the cellular process of an unpatched Android phone with a single eight-byte data SMS sent to port 2948. The bug sits in the improper validation of a header-length value in WapPushOverSms.decodeWapPdu: the value turns into -2147483648 as a signed 32-bit integer and triggers a NegativeArraySizeException, which kills com.android.phone.

Because Android handles the message before it reaches the inbox, victims see no sign of the cause. Connectivity drops and ongoing calls, including emergency calls, can be interrupted. In tests, about 20 malicious messages put a device into a reboot loop; one Android 12 phone rebooted into recovery roughly every 90 seconds and needed a factory reset.

Google reportedly fixed the issue in its October 2026 updates for newer Android versions, though it is not listed in the October bulletin. Devices on Android 12 and 13 that no longer get the fix remain exposed. A GitHub contributor found a way to remove the malicious messages using ADB.

## Sources

- [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/)

---
TechTools News · https://techtools.cz/tools/news/article/2617-new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones
Česká verze: https://techtools.cz/tools/news/clanek/2691-novy-exploit-sms-smrti-pro-android-dokaze-na-dalku-shodit-nezaplatovane-telefony