One hidden text can crash an Android phone’s calling system and drop emergency calls, and about 20 can trap it in a reboot loop. Android Headlines first reported the Android “SMS of Death” flaw, now tracked as CVE-2026-58882, and Google’s October 2026 update fixes it on Android 14 to 17.
Android 12 and 13 phones are the problem. The researcher’s disclosure site says those older versions run the same vulnerable code but sit outside Google’s security-update window, so they don’t get the fix. HotHardware estimates that about 18% of Android users are affected.
| Android version | Status |
|---|---|
| Android 12 and 13 | Outside the update window, no fix, and Google hasn’t said if there will be one |
| Android 14 to 17 | Fixed in the October 2026 update |
The attack needs no tap at all. According to the disclosure, the malformed WAP Push message arrives as a data SMS and “is never shown to the user: there is nothing in the inbox.” Each one knocks the phone off the network for one to two seconds while its phone process restarts, and any active call ends.
Digital Trends reports that researcher Mark Blaszczyk reproduced the crash on Google Pixel and Samsung Galaxy phones. Cybernews tested a Pixel 9 running April 2026 firmware and several Galaxy A-series models, and says it hit a “100% reproduction rate”.
Repeated messages are worse than one. Cybernews says the poison messages stay queued and retry on every boot, and the carrier keeps redelivering them. After roughly 90 seconds, Android’s RescueParty feature reboots the phone into recovery. Tech Advisor says a single message caused intermittent outages for up to a week in its testing.
It’s a denial-of-service bug, not a way to steal passwords or personal data. Digital Trends says there’s no confirmed evidence of widespread attacks so far. Blaszczyk published his findings with a working proof-of-concept app on GitHub on 29 October, and his own site calls it “a working weapon”.
A fix that took months, and a bulletin that doesn’t list it
BleepingComputer traced the cause to a header-length check in Android’s WAP Push code. An eight-byte message sent to port 2948 produces a negative number the code can’t handle. Google’s fix, titled “Fix remote DoS in decodeWapPdu”, catches that error and deletes the malicious messages from the SMS database.
Android Authority says Blaszczyk alerted Google on 5 May, and that Google “repeatedly dismissed his report as a non-security issue”. Android code records show Google developed a fix on 15 June, and GrapheneOS says it went out in security previews in July.
The flaw isn’t in Google’s October security bulletin, even though the October update carries the fix. Android Authority says it now has a “Critical” rating and is apparently slated for November’s bulletin, but Google hasn’t publicly explained the gap.
What to do
Install the latest security update and restart the phone. BleepingComputer says updates usually install automatically on supported devices, but availability depends on the manufacturer and carrier, and a restart may be needed.
If a phone gets stuck in recovery mode, Tech Advisor says not to tap “Wipe data”. Instead, connect it to a computer and clear the message with ADB. Android Authority warns that even a factory reset might not help if the carrier keeps resending the messages.
Owners of Android 12 and 13 phones have fewer options. HotHardware lists a factory reset, an ADB clean-up, a new phone, or a new number. Owners of the Nothing Phone (1) faced the same end of patches this year, and Tbreak’s Samsung trade-in guide explains what an old Galaxy is worth.
Google hasn’t said whether Android 12 and 13 will get a patch, and we don’t know when Samsung and other makers will roll the fix out to individual phones.
