Security researcher Mark Blah has released a proof-of-concept tool to exploit a recently patched vulnerability in the Android operating system, dubbed the "SMS of Death" and assigned the identifier (CVE-2026-58882). This vulnerability allows attackers to disable cellular communication services or crash targeted phones remotely and without any user interaction by sending a specially crafted text message.
This vulnerability is classified as a zero-click denial-of-service attack, as it can interrupt ongoing calls, including emergency calls. More dangerously, the Android system processes the message before it reaches the inbox, leaving the user with no visual indicator explaining why their device crashed.
How does the WapPushOverSms vulnerability work?
The technical researcher explained that the vulnerability stems from improper validation of the header length value in the (decodeWapPdu) function within the (WapPushOverSms) components in Android. To execute the attack, a malformed WAP Push message consisting of eight bytes can be sent to port (2948) as short message data.
When this value is translated into a 32-bit signed integer without boundary checks, it becomes (-2147483648). When Android attempts to allocate memory using this negative value, it triggers a (NegativeArraySizeException), causing the communication management process (com.android.phone) to crash. As a result, cellular connections are severed and devices malfunction.
Risks of repetition and reboot loops
The researcher's tests showed that sending 20 malicious messages could force phones into continuous reboot loops. On one Android 12 device, the phone restarted itself into Recovery Mode approximately every 90 seconds, necessitating a factory reset to restore device functionality.
Although Google has included a security patch that addresses the issue by catching exceptions and deleting malicious messages from the SMS database, older devices such as Android 12 and 13 remain vulnerable as they do not receive the update.
What does this mean for users?
With the proof-of-concept tool now publicly available, users of supported Android devices are advised to install the latest security updates as soon as they become available to protect their devices from potential attacks and prevent repeated system crashes.