New Android SMS of Death exploit can remotely crash unpatched phones
BleepingComputer • • technology
Key Points:
- A critical Android vulnerability, "SMS of Death" (CVE-2026-58882), allows attackers to remotely crash phones and disrupt cellular service by sending a specially crafted text message without user interaction.
- The flaw exploits improper validation in Android's WapPushOverSms.decodeWapPdu function, causing a NegativeArraySizeException that crashes the com.android.phone process, interrupting calls including emergency calls.
- Google patched the vulnerability in October 2026 updates for Android 14 through 17, but older versions like Android 12 and 13 remain vulnerable as they did not receive the fix.
- The exploit can cause repeated crashes and reboot loops, sometimes forcing users to perform a factory reset; removal of malicious messages requires advanced tools like Android Debug Bridge (ADB).
- Users are strongly urged to install the latest Android security updates promptly to protect against this denial-of-service attack, as a proof-of-concept exploit has now been publicly released.
![[Rumor] Persona 1 Remake Footage Leaked](https://media-cdn.cashwalklabs.io/https%3A%2F%2Fs3.us-west-2.amazonaws.com%2Fimages.cashwalklabs.io%2F0_admin%2Fnews-ai-images%2F01a193c7-9e89-741e-95ed-5d9b273de60b.webp?format=webp&w=120&h=80)
