Android SMS of Death Bug: Check Your November Security Patch

The Android SMS of Death bug, tracked as CVE-2026-58882, lets a single crafted text message cut off phone calls without the owner touching anything. Google rated it critical in the November 2026 Android security bulletin, published on November 2. A fix is available, and phone owners should confirm that it has been installed.

How the SMS of Death bug works

Independent security researcher Mark Blaszczyk found the flaw and disclosed it on October 29, 2026, on the site smsofdeath.com. He also published a proof of concept on GitHub. Tech outlets including Android Authority and GSMArena reported on it the following day.

The bug sits in the handling of WAP Push, a special type of SMS used to deliver configuration messages and notifications to phones. These messages never show up in the messaging app. Android processes them in the background through a component called WapPushOverSms, part of the operating system’s telephony layer.

The faulty code is the decodeWapPdu() function. According to Blaszczyk’s write-up, it reads a length value from the message header and converts it to a smaller number type without checking it first. A specially built five-byte value turns into a negative number. The system then tries to create a data buffer of negative size, fails with a NegativeArraySizeException error, and the com.android.phone process that handles calls crashes.

The recipient does not need to tap a link or open anything, which makes this a zero-click attack. The researcher’s page adds that the message triggers no notification and the sender’s number is not shown.

The fix took months to reach the public bulletin. Blaszczyk reported the issue through the Android & Devices VRP bug bounty program on May 5, 2026, along with a proposed bounds-check fix. According to Android Authority, Blaszczyk says Google first dismissed the report as a non-security issue. A Google engineer later wrote a fix on June 15, 2026. The researcher says that fix shipped in the October 2026 Android security update for Android 14 through 17. Google’s official bulletin on November 2, 2026, then listed CVE-2026-58882 with critical severity.

The impact on calls and cellular service

Each processed message leaves the phone without cellular service for roughly one to two seconds while the telephony process restarts. Any active call drops, including emergency calls. For someone calling an ambulance or an emergency number, even a short outage means dialing again from the start.

The disruption can repeat. Because the phone never acknowledges the message, the carrier may redeliver it and crash the phone again. In Blaszczyk’s testing, one message caused intermittent outages for up to a week. About 20 messages can reportedly leave a phone unusable for an extended period.

The malformed message also stays in the queue and is processed again every time the phone boots. An Android recovery mechanism called RescueParty can then push the device into recovery mode about every 90 seconds and offer to wipe its data. Data loss only becomes a risk if the user accepts that option.

The flaw is a denial of service bug, meaning it stops the device from doing its job. None of the sources we reviewed describe data theft or device takeover through this bug, and none report exploitation in the wild. The proof of concept is public, however, so anyone with bad intentions can study it.

Blaszczyk tested the attack on a Pixel 9 running April 2026 firmware and on several Samsung Galaxy and Galaxy A phones. He reports that it worked every time and that the behavior reproduces from Android 12 up to Android 16.

Affected Android versions and the fix

The researcher says the vulnerable code is present in Android 12 through 17. The November 2026 Android security bulletin lists CVE-2026-58882 in the System component as a critical DoS issue, with fixes for AOSP versions 14, 15, 16, 16-qpr2, and 17.

The fix belongs to the 2026-11-01 security patch level. Phones at that level or later carry it, while the 2026-11-05 level covers everything in the November bulletin. The researcher says the fix already shipped in the October update, and CyberInsider notes that its listing in the November bulletin does not mean every device updated in October is still vulnerable. Because the timelines differ, the safest benchmark is patch level 2026-11-01 or later.

Android 12 and 13 run the same code but do not receive this fix, according to the researcher and coverage by Security Affairs. Phones stuck on those versions remain exposed.

Timing also depends on the phone maker. Google fixes the Android source code, but each brand has to package the fix for every model before it reaches users. Android Authority wrote that the rollout schedule for individual devices remains unclear.

What this means for organizations using Android

Many organizations in Indonesia issue Android phones to field staff: couriers, sales teams, mobile community health workers, ambulance drivers, and rural banking agents. Those phones are used to call customers, coordinate during emergencies, and receive one-time passwords by SMS. For these teams, a dead phone line means work stops. IT teams can start on the following steps today.

Check the patch level on every device

On most phones, open Settings, tap About phone, then Android version, and look at the Android security update date, as described in Google’s help page. Menu names vary slightly by brand. Organizations that use mobile device management (MDM) can usually pull a patch level report for the whole fleet at once.

Install available updates

Open Settings, tap System, then the software update menu, and install whatever update is offered. The target is patch level 2026-11-01 or later. Schedule installs outside busy hours, since the phone needs to restart.

Flag phones that no longer get updates

List devices still running Android 12 or 13, or whose manufacturer has stopped shipping security updates. Such phones should not be the only calling channel for critical work, such as ambulance coordination in healthcare services or customer support lines. Put their replacement in the next budget cycle.

Prepare a procedure for boot loops

Tell users not to choose the wipe data option if the phone drops into recovery mode. The researcher’s page describes a recovery method using ADB, Android’s developer command-line tool, to remove the stuck messages without a factory reset. A technician should handle that step. Teams that work in emergencies also need a backup channel, such as internet-based calling or a second phone.

Teams that build their own apps can take a technical lesson from the case: the size of any outside data needs checking before use. Bounds checks like the one Blaszczyk proposed are a basic practice in secure mobile app development. For work phone fleets, Merakit’s cybersecurity services can help with device inventories and update policies.

Frequently asked questions

Can SMS of Death steal data from my phone?

The sources we reviewed describe it as a denial of service bug: the phone loses signal and calls drop. There are no reports of data theft through it. Data can be lost if the user chooses to wipe the device while it is in recovery mode.

How do I know whether my phone is protected?

Check the Android security update date in Settings. A date of November 1, 2026, or later means the fixes from the November bulletin are installed. According to the researcher, phones on Android 14 or later that received the October 2026 update also carry the fix.

Can Android 12 or 13 phones be secured?

Google’s bulletin lists fixes only for Android 14 through 17, and the sources we reviewed mention no official fix for Android 12 and 13. Ask the phone maker directly, and consider moving critical calling duties to devices that still receive updates.

Conclusion

CVE-2026-58882 shows how one small mistake in reading a number can disable the most basic function of a phone: making calls. The fix exists, so the main job for IT teams is to make sure every device receives it and to plan for the phones left behind. If your organization wants to tidy up how work devices get updated, the Merakit team is ready to talk.

Sources

• Android Security Bulletin, November 2026, Google, November 2, 2026
• SMS of Death, Mark Blaszczyk, October 29, 2026
• Android’s SMS of Death bug can knock out your phone, but a fix is coming soon, Android Authority, October 30, 2026
• A new vulnerability can brick your Android phone when receiving the SMS of Death, GSMArena, October 30, 2026
• SMS of Death: Android under attack, an invisible SMS can block calls and emergency services, Security Affairs, November 1, 2026
• Android November update fixes critical flaws and ‘SMS of Death’ bug, CyberInsider, November 3, 2026
• Check & update your Android version, Android Help, Google