Android 'SMS of Death' Text Can Crash Phones: Update Now

One special text message can crash an unpatched Android phone and drop calls. Here is how it works and how to protect your phone.

A security researcher has shared working attack code for an Android flaw called "SMS of Death." One special text message can crash an unpatched Android phone and cut off calls, even calls to emergency services. Install the latest Android security update today, then restart your phone.

What happened

According to BleepingComputer, a researcher named Mark Blah released a proof-of-concept for this flaw. A proof-of-concept is sample code that shows an attack really works. Now that it is public, more people can try it.

The flaw has an official tracking number, CVE-2026-58882. The researcher says Google fixed it in the October 2026 Android security updates for Android 14 through 17. The flaw is not listed in Google's October security bulletin, so news of the fix comes from the researcher. Older phones on Android 12 and 13 did not receive the fix and remain open to the attack.

How the trick works

The attacker sends a very short, broken message of a type called WAP Push. This is a kind of text message that phones handle in the background. Android reads a size number inside the message the wrong way. That mistake crashes the part of Android that runs your cell service.

• You do not have to tap anything. Experts call this "zero-click." The message does its harm as soon as it arrives.
• You see no sign. Android handles the message before it reaches your inbox. You will not see a strange text.
• Calls can drop. The crash cuts mobile service and can end a call in progress, including an emergency call.
• It can repeat. Carriers may try to deliver the message again. The phone may also try to read stored messages again. Each try can cause another crash.

This is a denial-of-service attack. That means it stops your phone from working. The report describes crashes and lost service. It does not describe stolen data.

Crash attacks like this are not only a phone issue. The Hacker News reports that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco firewall denial-of-service flaw to its list of known exploited flaws. A firewall is a tool that guards a network.

In testing, 20 of these messages could trap a phone in a reboot loop. A reboot loop is when a phone restarts over and over. One Android 12 phone restarted into recovery mode about every 90 seconds. The owner had to do a factory reset to fix it. A factory reset erases the phone and returns it to how it came from the store.

Who is at risk

• People with phones on Android 12 or 13. These did not get the fix.
• People on Android 14 through 17 who have not installed the October 2026 update yet.
• Small businesses that give Android phones to staff, especially staff who rely on calls.

Updates usually install on their own on supported phones. But the report notes that timing depends on your phone maker and your carrier. Some updates also need a restart before they take effect.

Steps to stay safe

1. Check your Android version. Open Settings and look for "About phone." The names may differ a little by phone maker.
2. Install the latest security update. Look under Settings for "Software update" or "System update." Install anything waiting.
3. Restart your phone. A restart may be needed to finish the update.
4. Check the security update date. On Android 14 through 17, look for an update from October 2026 or later.
5. Plan ahead if you have Android 12 or 13. These versions did not get this fix. Ask your phone maker or carrier what options you have. Keep another way to call for help close by.
6. Back up your phone. A recent backup keeps your photos and contacts safe if a reset is ever needed.
7. Help others. Check the phones of family members and workers.

What to do if you were hit

Signs of this attack include a phone that keeps losing signal, drops calls for no clear reason, or keeps restarting. You will not see the message itself.

• If your phone stays on long enough, install the update. Google's fix stops the crashes. It also deletes the bad messages from the phone's text storage, so they cannot keep causing trouble.
• If your phone is stuck restarting, there is one other option. A GitHub user named Sakis found a way to remove the bad messages using a tool called Android Debug Bridge. This tool connects a phone to a computer. It takes advanced skill, so ask a trusted tech helper.
• A factory reset may be the last step. In the tested case, this is what brought the phone back. It erases the phone, so use your backup afterward.
• Update right after you recover. On Android 14 through 17, install the latest update before you do anything else.
• Plan for emergency calls. This attack can end a call in progress. Keep a landline or a second phone nearby for emergencies.

Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.

Sources

• New Android SMS of Death exploit can remotely crash unpatched phones, BleepingComputer, 2026-10-31
• CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV, The Hacker News, 2026-10-30