This 'SMS of Death' exploit can remotely crash unpatched Android phones without the user interacting with it in any way

Date:
Mon, 02 Nov 2026 18:25:00 +0000

Description:
Older Android devices will remain permanently at risk, experts warn.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter A zero-click Android flaw let attackers crash phones with a specially crafted SMS message Repeated messages could trigger reboot loops, disrupt calls, and even affect emergency connectivity Google patched supported Android versions, but many end-of-life devices remain permanently vulnerable Picture this: Youre talking on your Android phone when all of a sudden you just lose mobile connectivity and your phone call drops. No explanation, no notification. Soon after, it happens again. And again. At one point, the device goes into recovery mode, rebooting every minute and a half until you finally perform a factory reset.

This is not a theoretical scenario - it is a real possibility, thanks to a critical-severity vulnerability in Android tracked as CVE-2026-58882. Google has patched the issue for newer versions of Android, but those who are past their end-of-life date will remain at risk. Latest Videos From TechRadar
Watch full video here: Sending an evil message The bug was discovered by security researcher Mark Blah and described as a zero-click denial of service (DoS) vulnerability. In more technical terms, it is an improper validation of a header-length value bug in Androids WapPushOverSms.decodeWapPdu function.
It was nicknamed SMS of Death because it can be exploited with nothing more than an SMS message, which the victims doesnt even have to open (hence the zero-click part).

As Blah discovered, a threat actor could send a malformed eight-byte WAP Push message to an Android devices port 2948: 01 06 88 80 80 80 00 BE. You may
like Android users beware if you own one of these budget smartphones, your device could be hacked with a simple video call Experts build WeChat worm
able to spread across millions of iPhone and Android devices via phone calls Experts say so-called 'Proactive SIM' cards can hijack smartphones, IoT devices and even EV chargers

Since this is a hex message, when it gets translated into a signed 32-bit integer, it becomes -2147483648. Android can then try to allocate memory
using this negative value, triggering a NegativeArraySizeException error that crashes the com.android.phone process. Since this process manages cellular functions, the call is dropped and mobile connectivity is disrupted. Even emergency services are susceptible, it was said.

It gets worse. Android processes messages before they reach the inbox,
meaning the victim will not be notified of the SMS and wont even know its the text message thats crashing the system. Also, some carriers will attempt to redeliver messages that never reached the inbox, extending the agony. Android also does its part by constantly trying to process messages already stored on the phone. Are you a pro? Subscribe to our newsletter Sign up to the
TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over.

Finally, Blah found that if a malicious actor sends 20 or more messages, they can force the device into a reboot loop. On an Android 12 device, they can force looped recovery mode, leaving factory reset as the only viable option. Patching the SMS of Death Initially, all Android versions were affected, it was said. Google patched it for versions 14 through 17, but older devices
will not be getting a patch and thus will remain at risk indefinitely. The
fix is called Fix remote DoS in decodeWapPdu, and apparently it prevents the crashes by catching exceptions triggered when Android processes malformed
text messages. It also deletes these messages from the SMS database so that they dont trigger repeat crashes.

Blah has released a proof-of-concept (PoC), showing the wider community exactly how to exploit the flaw, and BleepingComputer reported that a GitHub contributor found a way to remove the malicious message, but it requires more technical knowledge, which is something the majority of mobile phone users probably wont have. Still, those interested in tinkering should know that it can be removed via a computer, using Android Debug Bridge (ADB). What to read next Sanctioned billion-dollar cybersecurity company from Russia finds 11 vulnerabilities in Google and Apple products including a nasty one that compromised a device just through a malicious NFC tag Researchers find ultimate Windows kill switch which can disable antivirus with almost no user interaction Experts warn cheap Android phones are being shipped with malware built in, so be on your guard

Google apparently patched the bug in its October 2026 Android security
updates , but that doesnt automatically mean all Android users are safe. Unlike Apple s ecosystem, Android is diversified, and different manufacturers have different update cadences.

Therefore, while we can assume Pixel users have likely already received this update, Samsung users, as well as those using Xiaomi, Motorola, or OnePlus devices, will probably have to wait a little longer until their manufacturers apply the fix to their devices and push the update.

Still, since the PoC has been released, its safe to assume most Android manufacturers have already pushed their updates. Users are advised to install them as soon as possible. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/this-sms-of-death-exploit-can-remotely- crash-unpatched-android-phones


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)