Android SMS of Death Vulnerability Allows Remote Attackers to Crash Unpatched Devices via SMS.
Android SMS of Death Vulnerability Allows Remote Attackers to Crash Unpatched Devices via SMS.
Severity: CRITICAL (CVE-2026-58882)
CVSS V3.0 Score: Not Available
Information
Android Telephony Framework is a core component of the Android operating system responsible for managing cellular communication services, including phone calls, SMS messages, and mobile network connectivity.
WAP Push SMS is a type of specially formatted SMS message used to deliver information or service-related instructions to mobile devices. These messages can be processed automatically by the device without requiring user interaction and may not appear in the regular SMS inbox.
Incident
Security researcher Mark Blaszczyk disclosed a vulnerability in the Android Telephony Framework, referred to as "SMS of Death." The vulnerability allows remote attackers to send specially crafted WAP Push SMS messages to targeted Android devices, causing the com.android.phone process, which handles telephony functions, to crash without requiring any user interaction (Zero-click Attack).
The vulnerability is caused by improper handling of the WAP Push Message Header length, where insufficient input validation allows an Integer Overflow when converting a large numeric value into a smaller integer data type. This can trigger an exception during message processing and cause the telephony service to crash.
According to the researcher's testing, a specially crafted message can disrupt ongoing phone calls, including emergency calls. Repeated delivery of these messages may cause persistent crashes or a reboot loop, potentially leaving affected devices unusable. Recovery may require technical intervention using Android Debug Bridge (ADB).
Incident
Affected Systems
The vulnerability affects the Android Telephony Framework. The researcher reported successful testing on Google Pixel and Samsung Galaxy devices.
•Android versions 12–16 were identified as affected in the researcher's disclosure.
•A security fix was reportedly included in the October 2026 Android Security Update for Android versions 14–17.
•Older Android devices that no longer receive security updates may remain vulnerable.
The actual impact depends on the device model , firmware version, and installed security patch level.
Recommendation
1.Update Android devices to the latest operating system version supported by the device manufacturer to mitigate the vulnerability.
2.Restrict the use of devices that have not received the relevant security patches for accessing critical services or business systems until the vulnerability is addressed.
3.Consider replacing older Android devices that have reached End of Support and can no longer receive security updates with devices that are still supported by their manufacturers.
References
•https://www.androidauthority.com/android-sms-of-death-google-fix-3729929/
•https://cybernews.com/security/android-sms-of-death-critical-vulnerability/