Public exploit lets a single text message crash unpatched Android phones
Phones on Android 12 and 13 remain exposed, and some devices may need a factory reset after repeated attacks.
A researcher has published working exploit code for a zero-click denial-of-service flaw in Android, tracked as CVE-2026-58882 and nicknamed SMS of Death. A single crafted eight-byte WAP Push text sent to port 2948 makes Android's phone process crash, which can cut cellular service and drop active calls, including emergency ones, while the victim sees no message. Google reportedly fixed the issue in its October 2026 updates for Android 14 through 17, but the flaw is absent from its October bulletin, and Android 12 and 13 devices remain exposed. Repeated delivery of the malicious messages can trap a phone in a reboot loop, and one tester reported a device needing a factory reset. Users should install the latest security updates now that the exploit is public, though availability depends on manufacturer and carrier.
Why it matters
The exploit needs no action from the victim, so anyone running an unpatched Android phone can be knocked off cellular service, including during an emergency call. Because the exploit code is now public, the window for people on older or unpatched devices to be affected is open-ended, and whether they are protected depends on their manufacturer and carrier delivering the update.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.