An invisible text message can knock unpatched Android phones off the network

The phone shows nothing: no message in the inbox, no notification. Yet a few seconds later, it loses its network connection and any call in progress is cut off. On October 29, a researcher who goes by Mark B made public an Android flaw he named "SMS of Death." He published a technical analysis and exploit code at the same time.

All an attacker needs is the victim's phone number. The attacker sends a malformed data SMS, of the WAP Push type, to port 2948. Android processes this message before it even reaches the messaging app. A poorly checked length value turns into a negative number, which crashes com.android.phone, the process that handles telephony. The user has to do nothing: it is a "zero-click" attack. BleepingComputer tracks the flaw as CVE-2026-58882.

Who is protected, and who is not

Google fixed the flaw in the October 2026 security updates for Android 14 through 17, according to the researcher and BleepingComputer. However, the fix does not appear in Google's October security bulletin. Devices running Android 12 and 13 remain vulnerable: they are no longer covered by security updates and have not received the patch.

The timeline published by the researcher shows the process took a long time. He reported the flaw to Google on May 5. The fix was written on June 15, rolled out in October, and the flaw was made public on October 29. Google did not adopt the solution the researcher proposed, a simple check of the faulty value. It chose instead to catch the error and delete the booby-trapped message.

A crash that could repeat

A one-off outage would be annoying. The researcher describes something worse. The message stays stored: if it is processed again or if the carrier resends it, the crash starts over and the outage lasts longer. He also stresses that emergency calls in progress can be cut off.

According to BleepingComputer, sending twenty booby-trapped messages could be enough to trap phones in a reboot loop. A device running Android 12 rebooted into recovery mode roughly every 90 seconds. It had to be factory reset. Deleting the offending messages without wiping everything is possible with the ADB developer tool, but it requires a computer and solid technical skills.

What to do

The only documented protection is the update.

• Check the security patch level in the phone's settings (under "About phone," then "Android version"). It should show October 2026 or later. Restart after installing.
• Availability depends on the manufacturer and, sometimes, the carrier. If the update is not yet offered, check again in a few days.
• Phones running Android 12 or 13 should be considered unprotected. For businesses, this is one more reason to replace devices that no longer receive updates, especially those used by on-call staff or lone workers.
• Do not test the published code on a device you do not own.

The researcher points out that Android 12 and 13 run the same code but do not receive the fix. It remains to be seen whether some manufacturers will backport it to their models still on Android 12 or 13.