Android 'SMS of Death' (CVE-2026-58882): Which Phones Are Patched and What the Sources Disagree On
Updated November 3, 2026 · first published November 3, 2026
CVE-2026-58882, nicknamed the “SMS of Death”, is a flaw in Android's telephony code. A single malformed WAP Push message crashes the com.android.phone process without any user action, dropping calls and cellular service. A proof of concept is public. Reports say the fix reached Android 14 to 17 in October, but not Android 12 and 13, and sources disagree on Google's position.
Published 3 November 2026 · sources: ThaiCERT (2 November), Android Authority (30 October). Details are researcher-reported; Google has not published its own account.
How does the bug work?
Per the reports, the flaw is insufficient validation of the message header length in the WAP Push decoding path (WapPushOverSms.decodeWapPdu()), which raises a NegativeArraySizeException. The message is processed before it reaches the inbox, so the recipient sees nothing. The crash temporarily cuts cellular connectivity and ends active calls, including emergency calls. An attacker needs the target's phone number.
Repeated messages can repeat the crash. Android Authority quotes the researcher, Mark Blaszczyk, saying around 20 messages can leave a phone practically unusable, possibly in a boot loop, and that a factory reset may not help if the carrier resends the messages. ThaiCERT describes a reboot loop as a possibility, not a confirmed outcome. Treat the reboot-loop claim as researcher-reported.
Who is patched?
| Android version | Reported status |
|---|---|
| 14 to 17 | Fix applied in the October 2026 updates, per the researcher (ThaiCERT, citing BleepingComputer). GrapheneOS says the fix shipped earlier through its July security previews, and that the stock fix is scheduled for the November Android Security Bulletin. |
| 12 and 13 | Did not receive the fix in the October cycle. Devices that no longer get security updates may stay exposed. |
| Any version, on your device | Check your own patch level. Manufacturers can receive fixes before public bulletins, so the bulletin date is not the device date. |
What do the sources disagree on?
- Google's position. Android Authority reports that Google first said it was not a security issue and repeatedly dismissed the researcher's 5 May report; it also notes Android code records show a fix was developed on 15 June. Google has not explained the gap, and Android Authority had no reply when it asked. Some other outlets say Google marked the report “Won't Fix”; the Android Authority article does not use that phrase.
- Bulletin listing. ThaiCERT notes the CVE was not explicitly listed in the October 2026 Android Security Bulletin; other reports expect it in November's.
- Severity. Android Authority calls it Critical. It is a denial-of-service flaw, not a data-theft one.
What should a fleet owner do?
- Inventory by Android version and patch level. Devices on Android 12 or 13 are the first to check.
- Apply the latest manufacturer or carrier update on Android 14 and later, and verify the patch level after install.
- Plan replacement or isolation for devices that no longer receive security updates, as ThaiCERT advises.
- Ask your carrier whether it filters malformed WAP Push messages. We found no source confirming any carrier does.
- Do not rely on a bulletin alone. Confirm on the device.
Emergency patching has a cost that is easy to under-count; see the cost of emergency patch downtime and how AI-assisted vulnerability discovery changes the security budget.
Frequently asked questions
What is the Android SMS of Death vulnerability?
CVE-2026-58882 is a flaw in Android's telephony code. A malformed WAP Push message crashes the com.android.phone process without user action, which can drop calls (including emergency calls) and cut cellular service. A proof of concept is public; no exploitation in the wild is confirmed.
Which Android versions are affected and patched?
Researchers reproduced it on Android 12 to 16. The researcher says the fix was applied to Android 14 to 17 in the October 2026 updates, while Android 12 and 13 did not get it in that cycle. Check your own device's patch level, since rollout differs by manufacturer.
Can a text message really crash an Android phone?
According to the researcher and ThaiCERT, yes: a specially crafted WAP Push message, which never reaches the inbox, can crash the phone process. Reports of repeated messages causing a boot loop are researcher claims and not confirmed in every source.
Did Google refuse to fix it?
Sources conflict. Android Authority reports Google first said it was not a security issue but that a fix exists in Android's code, and that GrapheneOS says the stock fix is expected in the November bulletin. Google has not explained the discrepancy publicly.
Related
- The cost of emergency patch downtime
- AI-assisted vulnerability discovery and the security budget
- Claude Code extension backdoor: what to rotate and cap
Want this applied to your stack? Bring the provider bills, gateway logs, and top workflows; we will map the cost drivers and savings path. Book a free audit →