A single text message that the recipient never sees can crash phone service on an Android device, drop active calls including calls to 911, and trap the handset in a reboot cycle. The flaw, nicknamed "SMS of Death" and tracked as CVE-2026-58882, was published on Oct. 29 by security researcher Mark Blaszczyk, along with working proof-of-concept code. Google's fix is only now reaching phones through the October 2026 Android security update, and owners of older devices are left without one.
The vulnerable code sits in Android's core telephony framework. According to the smsofdeath.com disclosure site, it has been present since Android 12. Coverage has spread quickly, with reports from Cybernews, Android Authority and the German outlet heise online.
How one invisible text crashes a phone
The trigger is a malformed WAP Push message, a data-SMS format that carriers use for tasks such as carrier configuration. Most mobile attacks need the victim to open a link or approve something. This one needs nothing from the victim. A single crafted message crashes com.android.phone, the Android component that handles phone service, and any active call drops with it, emergency calls included.
The proof-of-concept is public. According to Cybernews, the app remotely and silently sends a crafted 8-byte WAP Push PDU over SMS to a target handset. Public code can shorten the time between disclosure and copycat attacks, which makes patch timing matter more for this flaw.
Reboot loops are the worst outcome. Carriers keep resending messages that never get confirmed, and Android stores them in a queue that is retried on every boot. ShiftDelete.Net reports that in the worst case the phone lands on the recovery screen roughly every 90 seconds. Because the queue survives restarts, rebooting the phone does not clear the problem by itself.
The message-count figures vary by source. PhoneArena says about 20 of these messages can render an Android phone completely useless. Mallory says rapid delivery of about 30 messages can corrupt the SMS database. USA 24 did not independently test either threshold, so treat both as reported figures rather than measured limits.
Why you will not see the attack coming
Most malicious texts give themselves away with an unfamiliar sender or a strange alert. This one does not. Unlike a normal SMS, the message never appears in your inbox, according to Android Authority, so there is no suspicious notification to ignore and no unknown contact to block.
That gap also weakens the usual advice. Most SMS scams people have learned to recognize depend on a lure, such as a link or a fake bank alert. This attack carries no lure at all, so training people to spot scam texts offers little protection here.
The invisibility complicates diagnosis too. A phone that drops calls or restarts repeatedly can look like a failing battery, a bad modem or an ordinary software bug. Few owners will think first about a text they never saw, which can delay the search for the real cause.
Which Android versions get the fix
Google's own code history matters here. According to Android Authority, Android's code records show the company developed the fix on June 15. According to researcher Mark Blaszczyk, Google included the fix in the October Android security updates for versions 14 through 17. Most reporting places the fix in the October 2026 release.
The bulletin timing is not settled, though. Android Authority reports that the fix is apparently slated for November's Android Security Bulletin, so some owners may see it later than the October label suggests. Google's bulletin is the document to check before assuming a given build is covered.
Older phones are the hard part. ShiftDelete.Net says phones on Android 12 or 13 fall outside the security update window and will not receive the fix. heise online adds that Google no longer supports those versions. Initial reporting lists the affected range as Android 12 through 17, and reproduced crashes span Android 12 to Android 16.
| Android version | Crash status | Fix status |
|---|---|---|
| Android 12 and 13 | Crashes reproduced | No fix, outside the update window |
| Android 14 to 16 | Crashes reproduced | Included in October 2026 security release |
| Android 17 | Listed as affected in initial reporting | Included in October 2026 security release |
How to check whether your phone is protected
Check the security patch level rather than assuming an update has arrived.
- Open Settings and find the security patch level, usually under About phone or software information. It should read October 2026 or later.
- Confirm the phone runs Android 14 or newer. Android 12 and 13 phones will not receive the fix, so upgrading the device is the only path to protection.
- Install any pending system updates as soon as they appear.
- Consider limiting exposure to unknown texts. None of the sources reviewed confirm that blocking unknown senders stops this message, so treat it as a partial measure.
Patch distribution varies by manufacturer and carrier, and the number of still-vulnerable US devices has not been reported, according to PhoneToday. Owners of any brand should check their own device rather than assume a release date means the update has reached them.
What to do if a phone is stuck in a reboot loop
The recovery guidance is technical. A GitHub thread in the smsofdeath project describes clearing the bad messages over ADB, the Android Debug Bridge. Its most drastic option erases all SMS and MMS messages and APN settings, which control how the phone connects to mobile data.
Average owners should not start there. Contact your carrier or a repair technician first. If the phone still boots long enough to copy photos and contacts, back them up before anything else. A factory reset should be the last resort, because it wipes data and settings the device needs to reconnect to the network.
Why emergency calls turn a bug into a safety problem
The smsofdeath.com disclosure site describes the flaw as a zero-click Android telephony denial-of-service issue. Denial-of-service bugs rarely draw the attention that data theft does, but this one interrupts the most basic function of a phone. If a 911 call drops mid-conversation, the caller may have to dial again while the phone is already struggling.
The costs fall unevenly. Owners of Android 12 and 13 phones bear the most risk, because they cannot get a fix at all. Carriers absorb support calls and must deal with resent messages. Google and device makers face pressure to push the fix to every eligible phone quickly.
The episode also exposes the limits of Android's update model. Phones receive security support for a fixed period, and many owners never think about that window until a bug arrives. A phone that falls outside it can become a liability even if its owner has no reason to suspect a problem.
What to watch next
Watch Google's Android Security Bulletin for CVE-2026-58882. Its listing will settle whether the fix arrived in October or November. USA 24 had not located a Google advisory for this CVE at publication, so the details here rest on the researcher's disclosure and press reporting.
Watch carriers too, since they control when many phones actually receive the update. Watch for reports of attacks in the wild. None appeared in the sources reviewed, but the public proof-of-concept means researchers and attackers both now have working code. The gap between disclosure and real-world abuse is the number to track over the coming weeks.
