SMS of Death: An 8-Byte Message Crashes Android and Blocks Emergency Calls

Security researcher Mark Blah, also known as Blaszczyk, disclosed CVE-2026-58882 on October 29, 2026, a zero-click vulnerability in Android's WAP Push SMS processor. No official Google bulletin covers this flaw; all information comes from converging editorial sources. The defect's severity lies not only in the attack's simplicity but in its systemic consequences: the crash of the com.android.phone process interrupts active calls, including emergency calls, and can trap the device in a persistent reboot loop. This story is chiefly a snapshot of Android patching fragmentation and the limits of coordinated disclosure when the vendor omits the CVE from official bulletins.

Google fixed the vulnerability in the October 2026 security update for Android 14, 15, 16, and 17, but omitted the CVE from the official bulletin. Android 12 and 13 do not receive the patch. Public disclosure includes a proof-of-concept exploit, making the attack replicable. Severity is classified as Critical, but Google has not published a numerical CVSS score.

The Mechanism: Long-to-Int Overflow in the WAP Push Parser

The vulnerability resides in the decodeWapPdu function of the WapPushOverSms component, responsible for decoding WAP Push messages received via data SMS on port 2948. The malicious payload, the exact sequence 01 06 88 80 80 80 00 BE, exploits an improper data type conversion: the value 0x80000000 (2,147,483,648 as an unsigned long) is interpreted as a signed 32-bit integer, producing -2,147,483,648.

This value is used as an array allocation size, triggering a NegativeArraySizeException that terminates the com.android.phone process. According to the researcher's tests, the phone service restart typically takes 1-2 seconds, during which the device loses all cellular connectivity. Blaszczyk reported a 100% reproduction rate on Google Pixel and Samsung Galaxy devices.

The malformed message generates no notification and does not appear in the SMS inbox: it is processed at the system level before the user has any awareness. This characteristic makes the attack completely invisible to the victim, who cannot adopt any preventive defensive behavior.

From Denial to Silence: The May 5 Case

The vulnerability's handling timeline reveals a non-linear path within Google's security response process. Blaszczyk reported the flaw on May 5, 2026; according to Android Authority, Google initially classified it repeatedly as a "non-security issue," excluding it from the bug bounty program and delaying priority assignment.

The fix was nevertheless implemented in the Android Open Source Project source code on June 15, 2026, but the path to distribution proved fragmented. The October 2026 update included the patch for Android 14-17, but CVE-2026-58882 does not appear in that month's security bulletin. GrapheneOS, a hardened Android distribution, clarified that the vulnerability will be included in the November 2026 bulletin and that it already received the fix via the July 2026 security previews.

This discrepancy between a distributed patch and official documentation raises questions about the transparency of Google's disclosure process: fleet administrators and users who consult bulletins to verify their device's security status would find no indication of the corrected risk.

The Bootloop Trap and the Technical Recovery Barrier

The single crash impact, while immediate, is transient. The critical condition emerges with the receipt of roughly 20 malformed messages: Android's RescueParty resilience system, detecting repeated crashes of the phone process at boot, forces the device into recovery mode. The researcher documented an Android 12 device repeating this cycle approximately every 90 seconds, rendering the phone completely unusable.

"A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim" — Mark Blaszczyk, security researcher

Recovery without data loss requires access via Android Debug Bridge (ADB), a development tool that requires prior enabling of developer options and USB debugging, or access to recovery with the ability to manipulate the SMS database. This procedure, documented for the first time by GitHub contributor Sakis, introduces a class barrier in the vulnerability response: users with technical skills or IT support can recover their data; others face a factory reset with consequent data wiping.

Why It Matters

Verified Facts: CVE-2026-58882 is a zero-click DoS vulnerability with impact on emergency calls. The proof-of-concept is public. Android 12 and 13 do not receive the patch. Google omitted the CVE from the October 2026 bulletin. The researcher documented a 100% reproduction rate on Pixel and Samsung Galaxy devices.

Editorial Analysis: This vulnerability exposes two systemic dynamics of Android patching. The first is support fragmentation: versions still circulating in the installed base remain unpatched while the vendor concentrates resources on newer releases. The second is coordinated disclosure opacity: when a vendor omits a CVE from the official bulletin, security posture management tools — which rely on those bulletins — do not flag the risk, creating a false sense of protection. The combination of a public proof-of-concept, absence of mitigation for non-technical users, and missing official documentation turns a technically simple flaw into a mobile security governance problem.

What to Do Now

No documented mitigations exist for non-technical users on Android 12-13. Users with devices upgradable to Android 14 or later must verify they have installed the October 2026 security update or later.

For enterprise fleet administrators, verifying patch status requires checking the specific OS version, not just the generic security patch level, since Google distributed the fix without including the CVE in the official bulletin.

The researcher published the proof-of-concept with the warning that use against third parties constitutes a crime, and that interference with the ability to contact emergency services is a serious criminal offense in most jurisdictions.

Sources and Limits of the Reconstruction

All information on CVE-2026-58882 derives from editorial sources: BleepingComputer, eSecurity Planet, Cybernews, Android Authority, and TechBytes. No official Google bulletin mentions this vulnerability. No ZDI or GHSL advisory exists. The researcher's name appears as "Mark Blah" in some sources and "Mark Blaszczyk" in others; this uncertainty is unresolved. TechBytes explicitly states it draws from BleepingComputer; mezha.net appears to aggregate third-party content. The numerical CVSS score has not been made public: sources indicate only Critical severity.

Sources

• bleepingcomputer.com
• esecurityplanet.com
• cybernews.com
• techbytes.app
• androidauthority.com
• mezha.net
• the420.in