So-called 'SMS of Death' can crash Android phones with just a text: what you need to know
A potentially debilitating SMS attack has been discovered that can crash Android phones, but a fix may already be in place.
A security flaw dubbed "SMS of Death" can crash Android phones through a repeating crafted text message. The attack, tracked as CVE-2026-58882, overloads phones by sending malformed SMS messages that disrupt cellphone service or crash devices. The flaw can interrupt ongoing calls, including emergency calls, without requiring user interaction.
The Android operating system processes the message before it reaches the inbox, so users might not immediately know the cause of the crash. Even rebooting the phone won't clear the issue, as the message remains queued and retried on every boot. Google has not yet responded to inquiries about the vulnerability, but the exploit was reportedly patched in the October 2026 Android security update.
The flaw affects Android versions 12 to 16 and was discovered on devices like Pixel 9s and Samsung Galaxy phones. The vulnerability arises from an improper validation of a header length in the Android WapPushOverSms.decodeWapPdu function. When the message is translated, it triggers a NegativeArraySizeException, causing the com.android.phone process to crash repeatedly.
The patch prevents crashes by catching exceptions and deleting the malicious messages from the SMS database. Users should ensure their phones are updated to the October 2026 Android security update, as updates may vary depending on the phone maker and network carrier.
Written by urgent.news from Tom's Guide's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
