01.09.2026
3 min
257
A critical vulnerability has been discovered in Android smartphones that allows attackers to remotely interrupt phone calls, including emergency calls, using an invisible SMS. The attack requires no interaction from the user, such as opening a message or clicking a link, while a series of malicious SMS messages can trap the device in an endless reboot loop.
The vulnerability was discovered by cybersecurity researcher Mark Blaszczyk, known online as @sourone. In his technical report, SMS of Death, he described a flaw in an Android system component responsible for handling phone calls. The vulnerability, tracked as CVE-2026-58882, affects devices running Android 12–16. The researcher also published a working exploit demonstrating how the attack can be carried out.
The attack exploits WAP Push, an outdated mechanism for delivering service messages over mobile networks. Carriers use it for tasks such as configuring devices or sending commands related to MMS delivery. These messages are processed automatically without requiring any user interaction. This is precisely what makes the attack so difficult to notice: an attacker only needs to send a specially crafted WAP Push SMS containing just eight bytes of data. The message never appears in the regular SMS inbox, and the smartphone owner does not even see the sender’s number.
When processing the message, Android incorrectly converts a numerical value representing the header length. Five bytes contain the number 2,147,483,648, which is initially read as a long integer but is then converted into a 32-bit int without checking whether the value is within the valid range. As a result of integer overflow, the value becomes negative: -2,147,483,648. The system attempts to use this number as an array length, triggering a critical error and crashing the com.android.phone process.
This component is responsible for cellular communication, so its failure immediately disconnects an active call, even if the person is speaking with emergency services. The user receives no warning that an attack is taking place. As the researcher explained:
“The victim does nothing. No tap, no open, no notification.”
After receiving the malicious SMS, the com.android.phone process crashes, causing cellular connectivity to drop for approximately one to two seconds. The system then automatically restarts the component, but the problem may not end there. Because the smartphone fails to acknowledge receipt of the message, the carrier may resend it. Android attempts to process the same data again, causing the phone service to crash once more.
The situation becomes even worse when an attacker sends multiple malicious SMS messages. According to the researcher, approximately 20 messages can trigger a prolonged denial-of-service condition, effectively rendering the smartphone unusable. The problematic messages remain in the incoming SMS queue, so the device repeatedly attempts to process them after each restart. Eventually, Android activates its built-in RescueParty recovery mechanism, which forces the smartphone into recovery mode after approximately 90 seconds.
An ordinary user facing this situation might assume that a factory reset is the only solution. Although this can restore the device’s functionality, it also deletes locally stored data. However, there is a way to recover without a full reset: the smartphone must be connected to a computer through Android Debug Bridge (ADB), allowing the problematic messages to be removed from the system queue. The procedure must be completed within a short window after Android boots, making it difficult for most users.
Mark Blaszczyk tested the exploit on a Google Pixel 9 running the April 2026 firmware, as well as several Samsung Galaxy smartphones, including models from the Galaxy A series. According to the researcher, the vulnerability was reproduced successfully in 100% of his tests, meaning every specially crafted message triggered the expected crash.
What makes the vulnerability particularly dangerous is that attackers do not need physical access to the device. The attack can be carried out remotely without installing additional software on the victim’s smartphone. The consequences can extend far beyond an ordinary system crash: if the message arrives during an emergency call, the conversation is immediately disconnected. While the device remains trapped in a reboot loop, the user cannot reliably access cellular services.
The researcher described the published proof-of-concept as an essentially ready-to-use tool for a destructive remote Denial of Service (DoS) attack. However, he emphasized that the code is intended exclusively for security research, educational purposes, and authorized testing.
“Using it against anyone else is a crime, and interfering with someone’s ability to contact emergency services (000) is a serious criminal offence in Australia and most other countries.”
The researcher reported the vulnerability to Google on May 5, 2026. By June 15, the company’s engineers had prepared a fix, which was later added to the Android Open Source Project (AOSP). The patch changed how errors are handled during WAP Push SMS decoding. The system can now catch the exception that previously caused the com.android.phone process to crash and remove the problematic message to prevent repeated failures after a restart.
The fix was included in the October 2026 Android security update for Android 14–17. However, this does not mean every device is already protected, as manufacturers must distribute the relevant patches to their smartphones. The situation is particularly concerning for Android 12 and 13, which also contain the vulnerable code, but many devices running these versions no longer receive regular security updates. As a result, some smartphones may remain vulnerable indefinitely.
GrapheneOS developers also announced that information about the vulnerability would be included in their November security bulletin. Android users are advised to check the date of their latest security update and install all available patches. For devices receiving the relevant fixes, protection against CVE-2026-58882 is provided starting with the October 2026 Android security patch level.
