So-called 'SMS of Death' can crash Android phones with just a text: what you need to know
Latest from Tom's Guide ·
Scott Younker is the West Coast Reporter at Tom’s Guide. He covers all the latest tech news, including phones, computing and more. He’s been involved in tech since 2011 covering everything from cameras and swimming pool equipment to the latest gaming consoles and smart TVs. He is on a seemingly never ending hunt to build the easiest to use home media system. Before Tom’s Guide, Scott worked for publications like Digital Trends, Outdoor Photographer, Dead Beats Panel , and in a brief detour, America’s Funniest Home Videos . Yes, he has seen more pratfalls, silly pets and ridiculous home movie fails than is reasonably healthy. When not writing about the latest devices or advances in chipsets, be sure to ask about Scott about disc golf and sustainability, or just if you’re being cheeky, ask about his noodle arm. If you truly want to get nerdy, bring up board games and his ongoing losing streak. Scott joined Tom's Guide in 2024 as the West Coast Reporter. He graduated from the School of Journalism at the University of Oregon with a degree in magazine journalism and a minor in communications. While there he blogged or wrote for several magazines including the Fluxx, Ethos and the Oregon Commentator. He briefly wrote and managed a moderately successful blog focused on web comics. Send secure tips on Signal: scyo1.55.
Late last week, a report popped up about a new Android phone exploit the security researcher dubbed "SMS of Death." Per the report , the attack, tracked as "CVE-2026-58882," lets malicious actors disrupt cellphone service or crash Android phones by overloading them with a repeating crafted SMS text message.
The denial-of-service flaw can even interrupt ongoing calls, including emergency calls, without requiring you to open the message. Apparently, the Android operating system processes the message before it even reaches your text message inbox, meaning you wouldn't immediately understand what caused the phone to crash.
Researcher Mark Blah says that even if you reboot your phone, the hacked message "stays queued and is retried on every boot, so the phone can crash on startup until it is cleared (recovery below)."
Upon finding Blah's report, Tom's Guide reached out to Google because the report claimed that Google had deemed it a "non-priority." Google has not yet responded to our inquiries.
However, some Android phones may already have the exploit patched.
Blah's report found that the exploit affects Android versions 12 up to 16 and was discovered on multiple devices, including Pixel 9s and Samsung Galaxy phones.
It appears Google patched the exploit in the October 2026 Android security update (if you haven't updated your Android phone, you should). However, that's only for Android versions 14 through 17. It does not appear to be available for any devices still running Android 12 or 13.
Per Blah, the flaw uses an improper validation of a header length in the Android WapPushOverSms.decodeWapPdu function. Attacks send a malformed WAP Push message to the targeted phone.
When this message is translated, it turns into a negative value that Android attempts to allocate memory for, which triggers a NegativeArraySizeException that crashes the com.android.phone process.
That process manages cellular functions, which disrupts connectivity and disconnects calls. This causes repeated crashes because the network tries to redeliver the malicious messages, which stack up and force Android to process each one. It only takes 20 bad messages to cause the crash.
Per the Google fix, the crash is prevented by catching the exceptions triggered by the attack messages. Then the patch deletes the messages from the SMS database to prevent them from looping.
Android security updates are generally automatically installed on supported devices. So you should already have them.
However, availability does depend on the phone maker and network carrier. So you should check your phone to see if the October patch has been applied. A restart may be required to complete the installation.
For the most part, this isn't an attack you can do anything about, but based on the patch notes and Blah's report, it doesn't seem to be widely deployed; instead, it appears to target individual phones. Since a working proof-of-concept of the exploit has been released, the best thing you can do is make sure you keep your phone up to date.