598/69 Monday, November 2, 2026
Researchers have disclosed CVE-2026-58882, a vulnerability in Android’s telephony system referred to as “SMS of Death.” An attacker who knows a target’s phone number can send a specially crafted WAP Push message that causes the com.android.phone process to crash, temporarily disrupting cellular connectivity and terminating active calls. No user interaction is required because the malicious message is processed before it reaches the messaging inbox. A Proof-of-Concept (PoC) has been published, but there is currently no confirmed evidence that the vulnerability has been exploited in the wild.
The vulnerability is caused by insufficient validation of the message header length in the WapPushOverSms.decodeWapPdu() function. A specially crafted message can trigger a NegativeArraySizeException, causing the telephony process to crash. Researchers reproduced the issue on Android 12 through Android 16 and reported that repeatedly sending the malicious message could cause continuous crashes or potentially force the device into a reboot loop. The fix introduced in AOSP adds error handling and removes the offending message from the system to prevent the crash from recurring.
Researchers stated that the patch was applied to Android 14 through Android 17 as part of the October 2026 updates, while Android 12 and Android 13 did not receive the fix in that update cycle. However, CVE-2026-58882 was not explicitly listed in the October 2026 Android Security Bulletin. Users should therefore install the latest updates provided by their device manufacturer or mobile carrier. Organizations should also review older Android devices still in use, particularly models that no longer receive security updates, and consider upgrading or replacing them where appropriate.