Security researcher Mark Blaszczyk has discovered a zero-click denial-of-service vulnerability in Android's internal messaging processing system, officially cataloged as CVE-2026-58882. The flaw, nicknamed the "SMS of Death," allows remote attackers to temporarily disable cellular communication or force vulnerable Android smartphones into crash loops simply by sending a specially formatted text message over carrier networks.
Because the system component processes the incoming data instantly in the background, affected smartphone owners do not need to click a link, open a message, or take any action for the crash to occur. The flaw impacts mobile devices operating on Android 12 through Android 17 that have not installed recent security patches.
Android Telephony Denial-of-Service Attack
WapPushOverSms component parses header length
NegativeArraySizeException
com.android.phone) crashes instantly
Behind the Flaw: How Hidden Data Crash Core Telephony
The flaw resides deep within WapPushOverSms, a legacy component responsible for handling Wireless Application Protocol (WAP) Push messages—an old data transfer standard originally created to deliver multimedia messages and network settings.
When a malicious WAP Push message arrives on cellular port 2948, the system attempts to process the message header without verifying whether its size parameter is valid. A 32-bit header integer without bound checks triggers a NegativeArraySizeException error, immediately crashing com.android.phone, the underlying background service responsible for cellular calls, text messaging, and SIM card management.
When com.android.phone crashes, active cellular signals drop instantly, cutting off ongoing voice calls, including emergency transmissions. Because mobile carrier networks do not receive a standard delivery acknowledgment (ACK) from the crashed device, cellular towers automatically retry sending the payload, creating a persistent feedback loop that can lock smartphones into continuous reboot states or trigger Android's internal RescueParty recovery routine.
Industry Impact and the Legacy Security Gap
Modern smartphone security relies heavily on zero-click protection mechanisms, as background components operate with high system privileges. The discovery highlights the ongoing challenge device manufacturers and wireless carriers face when maintaining backwards compatibility for decades-old networking protocols in modern operating systems.
For major original equipment manufacturers (OEMs) such as Google and Samsung, rapid security patch distribution remains vital to maintaining consumer trust across global mobile markets. Wireless service providers must also monitor cellular network traffic to prevent repeated messaging retry loops from generating unnecessary network noise and localized disruption.
The vulnerability creates a bifurcated security risk across the mobile ecosystem. While users on active software support timelines can resolve the issue through recent system updates, millions of older or unsupported Android handsets remain permanently exposed to potential remote service disruptions due to the end of vendor software maintenance lifecycles.
Immediate Mitigation and Patch Steps
Device manufacturers began deploying fixes for CVE-2026-58882 within recent security bulletins. Smartphone users should verify their system update level immediately to ensure protection against unauthorized telephony disruptions.
If your device enters a reboot loop caused by pending network retries, performing a factory reset is unnecessary and will cause permanent data loss. Removing the SIM card temporarily breaks the cycle.
To secure your device, open Settings, select System, and tap Software Update to install the latest patch. For users stuck in an active crash loop, temporarily removing the physical SIM card or placing the card into an updated device allows the cellular network to complete payload delivery without crashing the hardware.
Enterprise network administrators should enforce minimum operating system patch baselines across corporate fleets to prevent remote communication outages on unsupported endpoints.
Does the continued integration of legacy cellular protocols in modern mobile operating systems pose an unsustainable long-term risk to global network reliability?
