So-called 'SMS of Death' can crash Android phones with just a text: what you need to know

(Image credit: Shuterstock) Late last week, a report popped up about a new Android phone exploit the security researcher dubbed "SMS of Death." Per the report, the attack, tracked as "CVE-2026-58882," lets malicious actors disrupt cellphone service or crash Android phones by overloading them with a repeating crafted SMS text message.The denial-of-service flaw can even interrupt ongoing calls, including emergency calls, without requiring you to open the message. Apparently, the Android operating system processes the message before it even reaches your text message inbox, meaning you wouldn't immediately understand what caused the phone to crash.Researcher Mark Blah says that even if you reboot your phone, the hacked message "stays queued and is retried on every boot, so the phone can crash on startup until it is cleared (recovery below)."Upon finding Blah's report, Tom's Guide reached out to Google because the report claimed that Google had deemed it a "non-priority." Google has not yet responded to our inquiries.However, some Android phones may already have the exploit patched.October patch (Image credit: Sanuj Bhatia / Tom's Guide)Blah's report found that the exploit affects Android versions 12 up to 16 and was discovered on multiple devices, including Pixel 9s and Samsung Galaxy phones.It appears Google patched the exploit in the October 2026 Android security update (if you haven't updated your Android phone, you should). However, that's only for Android versions 14 through 17. It does not appear to be available for any devices still running Android 12 or 13.Get instant access to breaking news, the hottest reviews, great deals and helpful tips.Per Blah, the flaw uses an improper validation of a header length in the Android WapPushOverSms.decodeWapPdu function. Attacks send a malformed WAP Push message to the targeted phone.When this message is translated, it turns into a negative value that Android attempts to allocate memory for, which triggers a NegativeArraySizeException that crashes the com.android.phone process.That process manages cellular functions, which disrupts connectivity and disconnects calls. This causes repeated crashes because the network tries to redeliver the malicious messages, which stack up and force Android to process each one. It only takes 20 bad messages to cause the crash.Per the Google fix, the crash is prevented by catching the exceptions triggered by the attack messages. Then the patch deletes the messages from the SMS database to prevent them from looping.What you need to do (Image credit: Shutterstock)Android security updates are generally automatically installed on supported devices. So you should already have them.However, availability does depend on the phone maker and network carrier. So you should check your phone to see if the October patch has been applied. A restart may be required to complete the installation.For the most part, this isn't an attack you can do anything about, but based on the patch notes and Blah's report, it doesn't seem to be widely deployed; instead, it appears to target individual phones. Since a working proof-of-concept of the exploit has been released, the best thing you can do is make sure you keep your phone up to date. Follow Tom's Guide on Google News and add us as a preferred source to get our up-to-date news, analysis, and reviews in your feeds. More from Tom's GuideNow is the perfect time for Samsung to release a cheaper Galaxy Z Fold 9 FE — and it's all because of iPhone Duo3 Android Auto apps that do what Google Maps and Waze can’tiPhone Duo vs. Samsung Galaxy Z Fold 8: Which foldable is the best? Scott Younker is the West Coast Reporter at Tom’s Guide. He covers all the lastest tech news. He’s been involved in tech since 2011 at various outlets and is on an ongoing hunt to build the easiest to use home media system. When not writing about the latest devices, you are more than welcome to discuss board games or disc golf with him. He also handles all the Connections coverage on Tom's Guide and has been playing the addictive NYT game since it released.Something to share? Send secure tips on Signal: scyo1.55.