Vulnerabilities
Android phones can crash from a single text due to new vulnerability
A newly discovered Android flaw lets attackers crash or disrupt phones by sending a special text. Most devices running Android 12 or 13 remain unpatched, according to reports.
Ross Grant2 min read
The short version
A flaw in Android lets attackers crash phones or disrupt calls just by sending a special text message. Most newer phones have a fix, but many older devices are still at risk. The attack does not need the user to open the message. If your phone is affected, updating to the latest version is the best protection.
What happened?
A security researcher has released a proof-of-concept exploit for an Android vulnerability (CVE-2026-58882) that lets attackers crash phones or disrupt calls by sending a special text message. Google reportedly patched the flaw in October 2026 for Android 14 and newer, but Android 12 and 13 devices remain unpatched. Only one outlet has reported the issue so far.
How the flaw works
A security researcher has published details of a vulnerability in Android, tracked as CVE-2026-58882 and nicknamed "SMS of Death". The flaw allows an attacker to crash a phone or disrupt its cellular service by sending a specially crafted text message. The attack does not require the victim to open or interact with the message. Android processes the malicious message before it appears in the SMS inbox, so users do not see any warning or clue about what caused their phone to crash. According to BleepingComputer (opens in a new tab), the flaw is due to improper validation of a header-length value in the WapPushOverSms.decodeWapPdu function. When a malformed message is sent to port 2948, Android tries to allocate memory using a negative value, which crashes the com.android.phone process. This process manages mobile connectivity, so its crash can disconnect ongoing calls, including emergency calls.
Who is affected
Google reportedly fixed the vulnerability in its October 2026 Android security updates for Android 14 through 17. However, the flaw is not listed in Google's official October security bulletin, and devices running Android 12 and 13 have not received the fix. This leaves many older but still widely used phones vulnerable. The attack can be triggered by sending a specific eight-byte message from another Android device. In testing, sending 20 of these messages could cause a phone to enter a reboot loop, sometimes requiring a factory reset to recover.
The response
Google's patch, titled "Fix remote DoS in decodeWapPdu", prevents the crash by catching exceptions when Android processes malformed messages. It also deletes any malicious messages from the SMS database to stop repeated crashes. Security updates are usually installed automatically on supported devices, but their availability depends on the phone manufacturer and mobile carrier. A restart may be needed to complete the update. Now that a working exploit has been published, users are strongly advised to install the latest Android security updates as soon as possible.
What you should do
If your device is running Android 14 or newer, check that you have the October 2026 security update installed. For Android 12 or 13 devices, there is currently no official fix. Users of these versions should be especially cautious and consider upgrading if possible. If a device is stuck in a reboot loop due to this attack, recovery may require a factory reset, which erases all data. Advanced users can try removing malicious messages using Android Debug Bridge (ADB), but this requires technical skill and a computer.
Claimed vs confirmed
- Unconfirmed
Google has patched the vulnerability in Android 14 through 17.
BleepingComputer reports the patch, but it is not listed in Google's official October security bulletin.
- Unconfirmed
Android 12 and 13 devices remain unpatched and vulnerable.
Reported by BleepingComputer; no official statement from Google.
Why it matters
Phones running Android 12 or 13 may be vulnerable to remote crashes, including during emergency calls. The exploit is now public, making unpatched devices a target for attackers.
Key points
- A new Android flaw lets attackers crash phones with a single text message.
- The attack works without any user action or visible warning.
- Android 12 and 13 devices remain unpatched, according to reports.
- Google's fix is included in the October 2026 update for Android 14 and newer.
- Unpatched devices may require a factory reset if attacked.
Sources
BleepingComputer
Reference