KIungefiltert

· 4 min read · Auf Deutsch lesen

Android 'SMS of Death': One invisible text can knock out your phone, and Android 12 and 13 stay exposed

CVE-2026-58882: one crafted SMS crashes Android's phone service, even during emergency calls. Exploit code is public. Android 14 to 17 have a fix, while Android 12 and 13 likely won't get one.

security

Translated from the German original with an AI language model, approved by me. Read the original

One crafted text message is enough to knock out an Android phone remotely. Security researcher Mark Blaszczyk named the flaw "SMS of Death" and published a proof-of-concept, meaning working demonstration code. It's tracked as CVE-2026-58882. On X and in the WhatsApp channel I wrote briefly: "patched, install the update." That's true, but it's only half the story. More details have come out since, and things look worse for older devices.

What happened

The bug is in com.android.phone, the Android service that runs cellular connectivity, calls and SMS. When it handles a specific kind of SMS called a WAP Push message (a control message carriers use for things like configuration data), it doesn't check a length value in the header. A manipulated value turns into a negative array size, the service throws an unhandled exception, and it crashes. That's how BleepingComputer and heise describe it.

It's a zero-click attack: the victim doesn't have to tap anything. Android processes the message before it would reach the inbox. You never see it, only what it does:

  • Cellular service drops and ongoing calls are cut off. That includes emergency calls.
  • Carriers redeliver messages that weren't acknowledged. According to heise, a single SMS caused outages for up to a week in testing.
  • About 20 such messages sent one device into a reboot loop, restarting roughly every 90 seconds. Recovery mode then offers to wipe the data.

According to heise, the crash was reproduced on a Pixel 9 and several Samsung Galaxy devices. The attack takes the phone offline but doesn't steal data. None of the sources report real-world attacks. Because the code is public, though, copying it takes little effort.

What has changed since my post

Not every version is patched. Google shipped the fix ("Fix remote DoS in decodeWapPdu") in the October 2026 updates for Android 14 through 17. GrapheneOS says manufacturers already had it in security previews starting in July. Android 12 and 13 will probably never get a fix, because Google no longer supports them. Sources disagree on exactly which versions are affected: some say 12 through 16, others 12 through 17.

It's not in the October bulletin. According to heise and eSecurityPlanet, it's expected in the November bulletin, rated critical by Google. The November bulletin wasn't online yet as of today. There's no CVSS score (the standard severity scale) so far.

The disclosure didn't go smoothly. Blaszczyk reported the bug to Google on May 5. According to heise, the report was first closed as "Will Not Fix." GrapheneOS thinks this was an internal miscommunication. The fix only improves error handling: the service now catches the exception and deletes the bad message. It does not add the length check the researcher proposed.

What you should do

  1. Install the update and restart. Your security patch level is shown under Settings → Security or "About phone." On Android 14 through 17 it should say October 2026 or later. Your phone maker and carrier decide when the update reaches you, not Google.
  2. On Android 12 or 13? Check whether your device can still upgrade to a newer version. If it can't, no setting will protect you. Reports say WAP Push can't be turned off, and being careful with suspicious messages doesn't help when you never see the message. At that point it's time for a new phone, especially one meant for emergencies, like an older relative's.
  3. Stuck in a reboot loop? Do not choose "wipe data" in recovery mode, or you'll lose everything. According to the researcher, the messages can be removed with ADB (Android Debug Bridge, a tool for controlling the phone from a computer). That takes a computer and some experience. If that's beyond you, get help instead of resetting the phone.

My take

A crash sounds harmless until you think about emergency calls. The deeper problem is Android's update model: Google fixes the bug, and millions of devices on Android 12 and 13 still stay exposed for good. Before you buy an Android phone, check how many years of updates the manufacturer promises.

Sources