An Android vulnerability known as “SMS of Death” lets an attacker crash a phone by sending a specially crafted text message. The recipient doesn’t need to interact with the message for it to interrupt cellular service, disconnect a call, or potentially leave the device repeatedly restarting.
Tracked as CVE-2026-58882, the flaw was discovered by security researcher Mark Blaszczyk. He reproduced the attack on Google Pixel and Samsung Galaxy phones. Google has developed a fix, but whether a particular phone has received it depends on its Android version and security updates.
How the Android SMS of Death Vulnerability Works
The problem involves Android’s handling of WAP Push messages. These messages are processed by the operating system without appearing in the normal SMS inbox, and they ordinarily require no action from the phone’s owner.
Blaszczyk found that a malformed message can cause an error in Android’s telephony framework. That error crashes the process that manages cellular connectivity, disrupting the phone’s connection without requiring the recipient to do anything.
Because the message doesn’t appear in the regular inbox, the owner may not know what caused the disruption.
Dropped Calls and Repeated Phone Crashes
The vulnerability can disconnect a call already in progress, including a call to emergency services. Its effects can also continue beyond the initial interruption.
If a carrier tries to deliver the malicious message again, it can trigger another crash. During testing, approximately 20 malicious messages were enough to leave a smartphone in a reboot loop.
The flaw is a denial-of-service vulnerability. It disrupts the device’s operation; it isn’t designed to steal passwords or personal information. There is no confirmed evidence of widespread attacks against Android users.
Which Android Phones Have Received the Fix?
Exposure isn’t limited to one phone manufacturer. The relevant factors are the Android version installed on the device and whether it has received the required security patch.
According to Blaszczyk, Google’s October 2026 security updates included the fix for Android 14 through Android 17. However, Google did not list the vulnerability in its October security bulletin.
Phones running Android 12 or Android 13 haven’t received the fix, the researcher said. Devices on those versions that no longer receive security support remain exposed.
Although the attack was demonstrated on Pixel and Galaxy smartphones, those tests don’t establish that the problem is confined to Google and Samsung devices.
Check Your Android Security Patch Level
Checking the phone’s security patch level and installing the latest available Android update is the recommended precaution.
Security update information is usually available in the Settings menu. Its exact location varies by manufacturer, so the path won’t be identical on every Android phone.
Google having developed a fix doesn’t mean every device has received it. The phone’s installed security patch matters when determining whether the vulnerability has been addressed.
Blaszczyk notified Google about the issue in May and later released his findings with a working demonstration.
Recovering a Phone Stuck in a Reboot Loop
A factory reset isn’t the only recovery option described for an affected device. The offending messages can also be cleared using Android Debug Bridge (ADB).
That alternative involves a tool many everyday smartphone users won’t be familiar with. It provides another recovery route, but clearing the messages through ADB is a more technical task than checking for an update in Settings.
