From TechRadar · · 2m
SMS of Death exploit crashes unpatched Android phones
A zero-click vulnerability lets attackers remotely crash Android devices with a single malformed text message, triggering reboot loops and disrupting emergency calls.
In brief
A zero-click vulnerability lets attackers remotely crash Android devices with a single malformed text message, triggering reboot loops and disrupting emergency calls. A critical Android flaw tracked as CVE-2026-58882 lets attackers crash phones with a specially crafted SMS message. Google patched newer versions, but…
A text message crashes your phone
A critical Android vulnerability tracked as CVE-2026-58882 lets attackers crash phones with a specially crafted SMS message. Victims do not need to open it.
The damage spreads fast
Repeated messages trigger reboot loops, drop calls, disrupt mobile connectivity, and affect emergency services. Devices may enter recovery mode, rebooting every ninety seconds.
How the exploit works
Security researcher Mark Blah discovered the flaw. A threat actor sends a malformed eight-byte WAP Push message to port 2948: 01 06 88 80 80 80 00 BE.
The message crashes the phone process
When translated into a signed thirty-two-bit integer, the hex message becomes negative two billion one hundred forty-seven million four hundred eighty-three thousand six hundred forty-eight.
Android tries to allocate impossible memory
Android attempts to allocate memory using this negative value, triggering a NegativeArraySizeException error that crashes the com.android.phone process managing cellular functions.
Victims never see the message
Android processes messages before they reach the inbox, so victims receive no notification. Some carriers redeliver undelivered messages, extending the disruption.
Twenty messages force a reboot loop
If a malicious actor sends twenty or more messages, they can force the device into a reboot loop. On Android twelve, they can force looped recovery mode.
Google patched newer versions only
Google patched the flaw for Android versions fourteen through seventeen in its October twenty twenty-six security updates. Older devices will not receive a patch.
Manufacturers must push updates themselves
Unlike Apple, Android is diversified across manufacturers with different update cadences. Pixel users likely have the patch, but Samsung, Xiaomi, Motorola and OnePlus users must wait longer.
The headline
A critical Android flaw tracked as CVE-2026-58882 lets attackers crash phones with a specially crafted SMS message. Google patched newer versions, but end-of-life devices remain permanently vulnerable.
