Hidden text messages can crash unpatched Android phones
Nothing shows in the inbox, but a call in progress can drop, and about 20 messages can put a phone in a reboot loop. Android 14 to 17 have the fix; Android 12 and 13 do not.
Jump to a section
You are on a call when it suddenly drops. The signal vanishes for a moment and comes back. There is no new message in your inbox and no strange number to see, but your phone has just received a message built to crash its phone service.
This is the flaw a security researcher named SMS of Death, with details published on 29 October 2026. BleepingComputer reported on 31 October that it is tracked as CVE-2026-58882 and that working example code for the attack has been released.
The good news is that Google fixed it in the October 2026 security update for Android 14 to 17. The catch is that Android 12 and 13 did not receive the fix.
The message never reaches the inbox, but it crashes the phone service
The flaw sits in the part of Android that reads WAP Push messages. The attack message arrives as a data SMS, so it does not show in the inbox like a normal SMS, and the person targeted never sees the sender's number.
Picture a receptionist who opens every envelope before passing it on, until one day an envelope states a size so wrong that the receptionist cannot cope and the whole desk goes down. The researcher explained that Android reads a length value from the message without checking whether it is too large, so the value turns into a negative number and crashes the com.android.phone phone service.
The result is that calls in progress drop, including emergency calls, and the user does not have to tap or open anything.
About 20 messages can put a phone in a reboot loop
Carriers try to deliver again any message the phone has not acknowledged, so the phone can crash again and again. In the researcher's tests, about 20 messages put a phone into a reboot loop.
BleepingComputer reported that one Android 12 phone in testing rebooted into recovery mode about every 90 seconds and needed a factory reset to work again. The same report does not say the flaw has been used in real attacks.
Google fixed it in October, but Android 12 and 13 were left out
The researcher reported the flaw to Google on 5 May 2026, the fix was written on 15 June, and it reached users in the October 2026 security update, according to the timeline the researcher published. Google's fix catches the error so the phone service does not crash, and deletes the message that caused it.
That splits Android phones into two groups. The first is Android 14 to 17 phones that have installed the October 2026 update. The second is phones that have not updated, and Android 12 or 13 phones that will not get this fix. BleepingComputer also noted that the flaw is not listed in Google's October security bulletin.
Check your phone in a minute
According to Android Help:
- Open the Settings app
- Tap About phone, then Android version
- Look at Android security update. If it shows a date in October 2026 or later, your phone has the fix
- If it is older, go to Settings, tap System, then Software updates. Connect to Wi-Fi and charge the battery to at least 75% first
BleepingComputer noted that updates depend on the phone maker and carrier, and a restart may be needed to finish installing. Anyone on Android 12 or 13 who can no longer update should know the phone is still exposed. If a phone starts a reboot loop, the researcher's page advises against choosing wipe data straight away, because there is a way to delete the message that causes it from a computer using ADB.
Check your phone today, and check your parents' Android phones too.
FAQ
Are iPhones affected?
The sources used for this story only discuss Android. The flaw is in the part of Android that reads WAP Push messages.
Do I have to tap a link or open the message?
No. The message is processed before it reaches the inbox, so the user sees nothing and does not tap anything.
Which security update fixes it?
The Android security update of October 2026 or later, for Android 14 to 17.
What can Android 12 or 13 owners do?
The sources say these phones do not get the fix. If the phone starts a reboot loop, the researcher advises against wiping data straight away, and the researcher's page describes a way to delete the message using ADB.
