A researcher has released a proof-of-concept for CVE-2026-58882, nicknamed “SMS of Death.” It’s a zero-click bug: one crafted text and your phone’s cellular service crashes.
The details
- A malformed eight-byte WAP Push message makes a header length flip to -2147483648, and the resulting exception kills
com.android.phone. - That drops ongoing calls, including emergency calls, and it happens before the message ever shows up in your inbox.
- About 20 messages can put a phone in a reboot loop. One Android 12 test phone needed a factory reset.
- Google reportedly fixed it in the October 2026 updates for Android 14 through 17. The fix also deletes the bad messages. But it isn’t listed in the October bulletin, and Android 12 and 13 phones aren’t getting it.
My take
Install the October update and reboot. If you still carry an Android 12 or 13 phone, especially a backup or a family phone you rely on for emergency calls, it’s time to retire it. A public exploit that can drop 911 calls, with no fix for older phones, definitely isn’t fully right.
God Bless, and Needs Garlic!
