A single text message you never see could knock your Android phone off the cellular network, and even cut off an emergency call. That is the alarming scenario behind “SMS of Death,” a newly disclosed Android vulnerability that now has a public proof-of-concept exploit.
The good news is that a fix exists. Here is what the bug does, who is affected, and how to check that your phone is protected, based on reporting from BleepingComputer and Android Authority.
What is ‘SMS of Death’?
The flaw is tracked as CVE-2026-58882. It is a “zero-click” denial-of-service bug, which means the victim doesn’t have to tap, open or download anything.
According to BleepingComputer, an attacker sends a specially crafted WAP Push message, a type of data text message. Android processes it before it ever reaches your inbox, so there is no notification and no suspicious sender to warn you. Because of a missing bounds check, the malformed message causes the phone’s calling service, com.android.phone, to crash.
When that service crashes, the phone loses mobile connectivity and drops any ongoing calls, including calls to emergency services.
Why it can get worse
A single crash is bad enough, but the bigger risk is repetition. Android may try to process the same malicious message again, and carriers may try to redeliver it.
The researcher who found the bug said sending around 20 messages could leave a phone stuck in a reboot loop. On one Android 12 test device, BleepingComputer reports, the phone rebooted into recovery mode roughly every 90 seconds and needed a factory reset. Android Authority notes that even a reset might not provide lasting relief if the carrier resends the messages. A workaround to remove the messages exists, but it requires a computer and Android Debug Bridge (ADB), which is beyond most users.
The researcher reproduced the attack on Google Pixel and Samsung Galaxy phones, according to Android Authority.
Who is affected?
The vulnerable code dates back to Android 12. According to the researcher, Google included a fix in its October 2026 security updates for Android 14 through 17. That leaves two groups at risk:
- Phones on Android 12 or 13, which BleepingComputer says did not receive the fix.
- Any newer phone that hasn’t yet installed the October 2026 security patch or later.
Android Authority reports the flaw carries a Critical severity rating and is expected to appear in the November Android Security Bulletin. GrapheneOS said the underlying fix was distributed to manufacturers through security previews back in July.
How to check your phone in two minutes
Menu names vary by manufacturer, but the steps are similar on most Android phones:
- Open Settings and search for “Security patch” or go to About phone, then Android version.
- Look at the Android security update or security patch level date.
- If it is earlier than October 2026, go to Settings, then System (or Software update), and check for updates.
- Install any available update and restart your phone. A restart is often needed to finish installing.
- While you’re there, also check Google Play system update, which receives some fixes separately.
If your phone runs Android 12 or 13 and no longer receives updates, it is worth thinking about an upgrade. Ask your carrier or manufacturer whether a fix is coming for your model.
The bigger lesson
According to Android Authority, the researcher first reported the bug to Google in May and says Google repeatedly treated it as a non-security issue, even though Android’s code records show a fix was developed in June. Google hasn’t publicly explained the discrepancy. Whatever the reason, the episode is a reminder that patches only protect you once they actually land on your device.
Security updates usually install automatically on supported phones, but availability depends on your manufacturer and carrier. Now that a working exploit is public, it’s a good time not to put off that restart.
The wrap-up
SMS of Death is a rare kind of bug: invisible, zero-click, and able to interfere with emergency calls. The fix is simple for most people. Check your security patch level, update if needed, and restart. Two minutes now could save you a lot of hassle later.
Image: Early Android phone by EMOBILE by Syced via Wikimedia Commons, CC0 1.0
