A researcher released working attack code for an Android flaw that can crash a phone or cut off calls with one text. Older phones may stay exposed.
A researcher has published working attack code for an Android flaw that can knock a phone off the cellular network with a single text message. Nicknamed "SMS of Death" and tracked as CVE-2026-58882, it can crash a phone or cut off calls, including emergency calls. The person receiving the message does not have to tap or open anything.
The researcher, Mark Blah, says the problem is in how Android reads a certain kind of special text message. A length value inside the message is not checked properly. Android then tries to use a nonsense number, and the part of the phone that runs cellular service crashes. A crash there disrupts the mobile connection and ends calls in progress.
The message is handled before it reaches the inbox. That means the owner sees nothing that explains why the phone failed.
The damage can repeat. The researcher says crashes can happen again when a carrier tries to redeliver the bad message, or when Android processes messages already stored on the phone.
In tests, 20 malicious messages could trap phones in reboot loops. One Android 12 phone rebooted into recovery mode about every 90 seconds, and only a factory reset brought it back. A GitHub contributor named Sakis found a way to remove the bad messages, but it needs a computer and more advanced technical skill. The released attack code can send the messages from another Android device.
Google fixed the flaw in its October 2026 updates for Android 14 through 17. Those phones are protected once the update is installed. Phones on Android 12 and 13 did not get the fix and remain open to attack.
One more catch: the flaw is not listed in Google's October security bulletin, so that document is not a reliable way to check. Updates also depend on the phone maker and the carrier, and a restart may be needed to finish installing.
The alert box above lists the steps. The short version is to check for an update now, install it, and restart if asked. Owners of Android 12 and 13 phones should find out whether a fix will ever reach them.
Google's fix catches the error the bad message causes and deletes the malicious messages from the phone's text database. That stops the repeat crashes on patched phones. The material does not say whether Android 12 and 13 will get the fix, or whether attacks are already happening. With working code now public, installing updates on supported phones is the sensible move.
Check for an Android update today, and if your phone runs Android 12 or 13 with no update, ask the maker or carrier about a fix.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
