\"SMS of Death\" can remotely disable an Android phone. A fix exists, but older phones will likely not receive it

Your phone hangs up on its own in the middle of a call, loses signal for a moment, and then starts restarting repeatedly. This exact scenario is described by security researcher Mark Blaszczyk, who published an Android vulnerability with the telling nickname SMS of Death. It affects Android versions 12 to 17, and the attacker only needs to know your phone number.

One message is enough, and you won’t even see it

As Blaszczyk describes on the website dedicated to the bug, this is an attack where the victim doesn’t have to do anything wrong (unlike, for example, phishing). The attacker sends a modified WAP Push message – an outdated type of SMS that operators use to send hidden instructions to phones, such as for downloading MMS or network settings. When processing it, Android encounters an incorrectly handled value, and the system service for calling crashes. Ongoing calls are immediately terminated, including those to emergency lines. Moreover, the message is not displayed at all, so you don’t even see the sender’s number.

What follows is worse. The phone attempts to process the message again at every startup, so the crash repeats. According to the researcher, approximately 20 such messages are enough to render the phone practically unusable. It restarts into recovery mode approximately every 90 seconds, offering to erase data. Furthermore, operators repeatedly deliver unconfirmed messages, so in his tests, a single SMS caused outages for up to a week. He replicated the bug with 100% success on a Pixel 9 and several Samsung Galaxy phones.

Google initially rejected the bug, but a fix now exists

Blaszczyk reported the bug to Google on May 5th. Google allegedly repeatedly dismissed it as a non-security issue and closed the report as “Will Not Fix.” Therefore, on October 29th, the researcher published details and a working demonstration of the attack. However, as the German server Heise Online points out, Google engineers had already prepared a fix by June 15th. According to the GrapheneOS project, manufacturers received it in July as part of preliminary security packages, so the rejection of the report might have been an internal misunderstanding.

The bug is designated CVE-2026-58882 with critical severity and is expected to appear in the November security bulletin. The fix itself, according to the researcher, is part of the October security update for Android 14 to 17, and phones with a security level from October 2026 or newer are protected. However, since Google will officially include the bug in the November bulletin, the November patch will provide more certainty. You can find the security level in your phone’s settings, usually in the About phone section. When individual phones receive the patch depends on their manufacturers.

Owners of older devices with Android 12 and 13, which Google no longer supports, are worse off. They will likely not receive the fix unless their manufacturer prepares it themselves.

What security level does your phone currently have?

Sources: SMS of Death (Mark Blaszczyk), heise online, Android Authority