Android’s ‘SMS of Death’ Can Drop Your Calls With One Hidden Text. Here’s Who Is Still Exposed

One text message. You never see it, it never lands in your inbox, and you never tap anything. But if your Android phone hasn’t been patched, that message can knock out its calling service for a second or two, and enough of them can push the phone into a reboot loop that ends with a factory reset.

That’s the short version of the “SMS of Death,” a bug security researcher Mark Blaszczyk made public on October 29 with a working demonstration. It’s tracked as CVE-2026-58882, it affects phones running Android 12 and later, and Blaszczyk reproduced it on Google Pixel and Samsung Galaxy phones. The good news: most recent phones already have the fix. The bad news: millions of older ones probably never will.

What the SMS of Death actually does

The attack abuses WAP Push, an old SMS format carriers use to deliver things like configuration settings. Android processes these messages quietly in the background, which is why the victim never sees anything.

According to Blaszczyk’s write-up, as detailed by Cybernews, the trigger is an 8-byte WAP Push payload with a deliberately absurd header length: 0x80000000, or 2,147,483,648. Android converts that number to a 32-bit integer without checking its range, it flips to a negative value, and the resulting error kills com.android.phone, the system process that handles calls and cellular service.

“A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls,” Blaszczyk wrote.

On its own, one crash is a nuisance. Service drops for about one to two seconds and the process restarts. The trouble is what happens next. Because the phone never acknowledges the message, the carrier keeps redelivering it, and the message is retried on every boot. Blaszczyk found that roughly 20 of these messages can cause a persistent denial of service. Android’s built-in RescueParty safety net then reboots the phone into recovery after about 90 seconds, which nudges owners toward wiping the device.

The part that should worry people most: any call in progress is dropped when the phone process dies. That includes emergency calls.

What it can’t do

This is a denial-of-service bug, not spyware. Digital Trends notes it doesn’t steal passwords or personal data, and there are no confirmed reports of widespread attacks so far. But a proof-of-concept app is now public on GitHub, so the barrier to misuse is lower than it was a week ago.

Which Android phones are patched, and which aren’t

Your phone’s brand matters less than its Android version and its security patch date. Here’s where things stand based on the researcher’s account.

A caveat on timing. Blaszczyk says the fix reached Android 14 through 17 in Google’s October 2026 updates, and Google committed the code to the Android Open Source Project back on June 15. Yet Google’s October security bulletin didn’t mention the flaw, and the GrapheneOS team has said it will appear in the November 2026 bulletin. We’re going with the researcher’s account, since he tested it, but if your phone maker is slow, a November patch is the one to look for. Google’s November Pixel update is expected to start rolling out this week.

It’s also worth remembering how this started. Blaszczyk reported the bug to Google in May, and Google initially didn’t treat it as a security issue before its engineers built the fix. For a flaw that can cut off a 911 call, that’s an uncomfortable detail.

How to check your phone in under a minute

1. Pixel: Open Settings, then Security & privacy, then System & updates. Look at the Security update date.
2. Samsung Galaxy: Open Settings, then About phone, then Software information. Check “Android version” and “Android security patch level.”
3. Other brands: Search Settings for “security patch.” The wording varies by manufacturer.
4. If you’re on Android 14 or newer with a patch dated before October 2026, go to the system update screen and install whatever is waiting.
5. If you’re stuck on Android 12 or 13, there’s no setting that blocks WAP Push for regular users. The real fix is a phone that still gets security updates.

If your phone is already stuck in a crash loop

A factory reset clears it, at the cost of anything that isn’t backed up. The alternative is connecting the phone to a computer and using Android Debug Bridge (ADB) to delete the queued message data in the short window after boot. That works, but it’s a developer tool, and most people will reasonably reach for the reset instead. This is a good moment to confirm your Google account backup is actually turned on.

Our take

Android’s update story has improved enormously. Pixels and recent Galaxy flagships now promise seven years of updates, and that’s exactly why this bug is mostly a non-event for someone holding a 2024 or 2025 phone. The people exposed are the ones who were always going to be exposed: owners of older or cheaper devices whose support quietly ran out.

That group skews toward kids’ hand-me-down phones, backup devices, and budget models bought for a parent. If one of those phones is somebody’s only way to call for help, check its Android version tonight. A $200 replacement that still gets patches is cheap insurance against a text message nobody will ever see.

Sources: Digital Trends, Cybernews, GSMArena. Photo by Gilles Lambert on Unsplash.