One Text Message Can Knock an Unpatched Android Phone Off the Network: Your Questions About the “SMS of Death” Answered
A public exploit for an Android flaw nicknamed “SMS of Death” can crash the phone’s cellular service with a single malformed message, dropping calls, including emergency calls. Android 14 through 17 got a fix in October; Android 12 and 13 did not. Here is what businesses with Android phones should do.
A researcher has published working code for an Android bug that lets anyone with the right message knock a phone off the cellular network, with no tap, click or warning required. Here are the questions business owners are most likely to ask, answered from BleepingComputer’s write-up of the exploit.
What exactly happens to the phone?
The flaw, tracked as CVE-2026-58882 and nicknamed “SMS of Death,” crashes com.android.phone, the part of Android that runs cellular service. When it goes down, mobile connectivity drops and any call in progress is cut off, including a call to emergency services. The phone handles the message before it ever reaches the inbox, so the owner sees nothing that explains the crash.
How does a text cause that?
The attacker sends a malformed WAP Push message only eight bytes long. Android reads a length value in its header without checking whether it makes sense, the value turns into a large negative number, and the attempt to reserve memory with it throws an error that brings down the phone process. Researcher Mark Blah, who found the bug, has published a technical analysis along with a proof-of-concept that sends the messages from another Android phone.
Is it a one-time glitch?
Not necessarily. The crash can repeat when the carrier tries to deliver the message again or when Android re-reads messages already stored on the device. In testing, 20 malicious messages were enough to trap phones in reboot loops. One Android 12 phone kept dropping into recovery mode roughly every 90 seconds and only came back after a factory reset.
Which phones are fixed?
According to the researcher, Google quietly fixed the bug in its October 2026 updates for Android 14, 15, 16 and 17, although the issue does not appear in Google’s October security bulletin. The fix catches the error and also deletes the bad messages from the phone’s SMS database so they cannot keep causing crashes. Phones on Android 12 and 13 did not get the fix and remain exposed.
Can a stuck phone be saved without wiping it?
Possibly. A GitHub contributor known as Sakis found a way to remove the malicious messages with Android Debug Bridge (ADB), but it requires a computer and more technical skill than most users have.
Why does this matter now?
Because the exploit is public. Before, only someone who understood the bug could use it; now anyone can download the code. Android updates usually install automatically on supported phones, but they depend on the manufacturer and carrier, and many need a restart to finish.
What this means for your company
If your team relies on Android phones for customer calls, field work or two-factor codes, a phone that keeps rebooting is a real business interruption, and a dropped emergency call is worse. Check the Android version and security patch level on every company phone and on personal phones used for work. Make sure October 2026 or newer patches are installed and that phones have actually restarted. Plan to replace anything still on Android 12 or 13, since those devices are not getting this fix, and keep a spare or a backup way to reach critical staff in case a phone goes down.
Need help tracking which phones in your fleet are patched and which are overdue for replacement? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
