This 'SMS of Death' exploit can remotely crash unpatched Android phones — without the user interacting with it in any way
A zero-click bug crashes phones with no interaction from the user
by https://www.techradar.com/author/sead-fadilpai · TechRadarNews By Sead Fadilpašić Published 2 November 2026
Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter
- A zero-click Android flaw let attackers crash phones with a specially crafted SMS message
- Repeated messages could trigger reboot loops, disrupt calls, and even affect emergency connectivity
- Google patched supported Android versions, but many end-of-life devices remain permanently vulnerable
Picture this: You’re talking on your Android phone when all of a sudden you just lose mobile connectivity and your phone call drops. No explanation, no notification. Soon after, it happens again. And again. At one point, the device goes into recovery mode, rebooting every minute and a half until you finally perform a factory reset.
This is not a theoretical scenario - it is a real possibility, thanks to a critical-severity vulnerability in Android tracked as CVE-2026-58882.
Google has patched the issue for newer versions of Android, but those who are past their end-of-life date will remain at risk.
Latest Videos FromTechRadarWatch full video here:
Sending an evil message
The bug was discovered by security researcher Mark Blah and described as a zero-click denial of service (DoS) vulnerability. In more technical terms, it is an “improper validation of a header-length value” bug in Android’s WapPushOverSms.decodeWapPdu function. It was nicknamed “SMS of Death” because it can be exploited with nothing more than an SMS message, which the victims doesn’t even have to open (hence the ‘zero-click’ part).
As Blah discovered, a threat actor could send a malformed eight-byte WAP Push message to an Android device’s port 2948: 01 06 88 80 80 80 00 BE.
Since this is a hex message, when it gets translated into a signed 32-bit integer, it becomes -2147483648. Android can then try to allocate memory using this negative value, triggering a NegativeArraySizeException error that crashes the com.android.phone process. Since this process manages cellular functions, the call is dropped and mobile connectivity is disrupted. Even emergency services are susceptible, it was said.
It gets worse. Android processes messages before they reach the inbox, meaning the victim will not be notified of the SMS and won’t even know it’s the text message that’s crashing the system. Also, some carriers will attempt to redeliver messages that never reached the inbox, extending the agony. Android also does its part by constantly trying to process messages already stored on the phone.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors