.jpg) A security researcher has unveiled a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as **CVE-2026-58882**. This flaw enables attackers to remotely disrupt cellular service or crash target phones by sending a specially crafted text message. ### Zero-Click DoS and Emergency Call Disruption This zero-click denial-of-service vulnerability can interrupt ongoing calls, including emergency calls, without requiring any interaction from the target user. What's particularly concerning is that Android processes the malicious message before it even reaches the SMS inbox, leaving victims with no visible indication of what caused their device to crash. According to vulnerability researcher **Mark Blah**, **Google** reportedly patched this vulnerability in its **October 2026 Android security updates** for Android 14 through 17. However, the flaw is notably absent from Google's official October security bulletin, and older Android 12 and 13 devices remain vulnerable as they did not receive the crucial fix. ### Technical Breakdown of the Flaw Blah published a technical analysis of the flaw, which stems from improper validation of a header-length value within Android's `WapPushOverSms.decodeWapPdu` function. To exploit the vulnerability, an attacker can send the following malformed eight-byte WAP Push message to targeted phones: When this value is translated into a signed 32-bit integer without a bounds check, it becomes -2147483648. When Android attempts to allocate memory using this negative value, it triggers a `NegativeArraySizeException` that crashes the `com.android.phone` process. As the `com.android.phone` process manages all cellular functions, this crash directly disrupts mobile connectivity and disconnects any ongoing phone calls, including calls to emergency services. ### Persistent Crashes and Factory Resets The researcher warns that the attack can also cause repeated crashes when carriers attempt to redeliver malicious messages or when Android tries to process messages already stored on the device. During testing, sending 20 malicious messages could force phones into persistent reboot loops. On one Android 12 device, the phone rebooted into recovery mode approximately every 90 seconds, ultimately requiring the user to perform a factory reset to regain functionality. A **GitHub** contributor named **Sakis** discovered a method to remove the malicious messages using Android Debug Bridge (ADB), but this process requires advanced technical knowledge and access to a computer. **Mark Blah** has published a proof-of-concept exploit that can send these malicious messages from another Android device. ### Google's Patch and User Recommendations Google's fix, titled "Fix remote DoS in decodeWapPdu," prevents the crashes by catching exceptions triggered when Android processes the malformed text messages. The patch also includes a mechanism to delete malicious messages from the SMS database, preventing them from triggering repeated crashes. While Android security updates are generally installed automatically on supported devices, their availability is contingent on the device manufacturer and carrier. A restart may also be required to complete the installation process. Given the public release of a working proof-of-concept exploit, Android users are strongly advised to install the latest available security updates to protect their devices from this critical vulnerability.