Proof‑of‑Concept Demonstrates Remote Crash of Unpatched Android Devices via “SMS of Death” Exploit

A security analyst released a proof‑of‑concept showing that the newly patched Android vulnerability known as CVE‑2026‑58882, dubbed “SMS of Death,” can be activated with just one specially crafted SMS, causing the phone to drop its cellular connection or restart outright.

The flaw lies in how the Android messaging stack interprets specific SMS payloads. Inserting a corrupted byte sequence can make the service that processes incoming texts overflow its buffers, resulting in a denial‑of‑service. The author’s implementation transmits the rogue SMS from a regular handset or a web‑based gateway, demonstrating that no authentication or user action is needed.

Although the attack is aimed at phones that missed the security update rolled out earlier this month, the patch corrects the parsing mistake. Google’s advisory indicates that Android 12 and 13 versions without the fix are vulnerable, encompassing a large number of devices still actively used globally. Unpatched users could see abrupt loss of voice and data service or an unforeseen reboot when the malicious SMS is received.

Attacks via SMS have been observed before; prior “SMS of Death” events in 2011 and 2017 exploited comparable buffer‑overflow vulnerabilities to crash devices or run code. Those incidents forced vendors to reinforce the messaging subsystem, yet the repeat appearances of this problem highlight how challenging it is to fully protect legacy code that must support many carrier‑specific formats.

Google acted quickly. Alongside the patch, it released a security bulletin urging users to apply the update through Settings → System → Advanced → System update. The Android Security Team also advised carriers and OEMs to distribute the fix via over‑the‑air (OTA) updates to reach phones that might miss manual updates.

Experts note that the proof‑of‑concept underscores how devices can stay exposed long after a fix is available until users install it. Security specialists recommend checking that the Android version contains the newest security patch, steering clear of apps from untrusted sources, and treating unexpected messages with suspicion. As mobile OSes evolve, the sector is expected to adopt more proactive disclosures and accelerate patch cycles to neutralize comparable threats before they can be widely weaponized.