A security researcher has published details of an Android flaw he calls SMS of Death. One malformed text message, which never shows up in the inbox, crashes the phone's calling service. Any active call drops, including emergency calls, and the victim does not have to tap anything. The bug is tracked as CVE-2026-58882, and the researcher, Mark Blaszczyk, reported it to Google on 5 May 2026 and disclosed it publicly on 29 October, alongside a working demonstration.

The bug sits in WapPushOverSms, part of Android's telephony framework. A malformed WAP Push SMS, a data message sent to port 2948, crashes com.android.phone, the system process that handles calls. The flaw is an improper validation of a header-length value: a crafted value turns negative, Android tries to allocate memory of that negative size, and the process crashes. The researcher reproduced the crash every time on a Pixel 9 and several Samsung Galaxy phones.

Which phones get the fix

Google has a fix, but its availability across devices is another matter. The researcher says the fix has already reached Android 14 through 17 as part of Google's October 2026 security updates, but the vulnerability was not mentioned in Google's October bulletin. Android Authority reports that the fix appears to be slated for Google's November bulletin instead, citing GrapheneOS. Google publishes bulletins on the first Monday of each month, which this month is November 2.

Devices running Android 12 and 13 have not received the fix on the researcher's account. There is no confirmed evidence of widespread attacks, and the flaw threatens availability rather than data: nothing in the disclosure suggests it lets an attacker steal personal information or take control of a phone. Check the patch level in Settings, but treat a date there as a guide, not a guarantee, until the November bulletin confirms the listing.