Security researcher Mark Blah published a proof-of-concept for an Android phone-crashing flaw
Security researcher Mark Blah released a proof-of-concept for Android’s “SMS of Death” flaw, demonstrating that a specially crafted text can remotely crash phones and disrupt cellular service without user interaction. The crash can disconnect ongoing calls, including emergency calls. Android 12 and 13 devices reportedly remain unpatched, while Blah says Google’s October updates reportedly patched Android 14–17.
More context
Security researcher Mark Blah has published a proof-of-concept for an Android flaw dubbed “SMS of Death,” tracked as CVE-2026-58882, that can remotely crash phones with a specially crafted text message. Blah’s technical analysis says Android failed to validate a header-length value in the WapPushOverSms component, allowing it to be interpreted as negative and crash the com.android.phone process. The crash can disrupt cellular service and disconnect active calls, including emergency calls. Blah said Google had reportedly patched the flaw in October 2026 security updates for Android 14 through 17, though it is not listed in Google’s bulletin. Android 12 and 13 devices did not receive the fix and remain exposed. In testing, 20 malicious messages could trigger reboot loops; one Android 12 phone rebooted into recovery mode about every 90 seconds and required a factory reset.
Was this story useful?
What was the main problem? (optional)
Reporting
Verifier’s note
BleepingComputer reports that a specially crafted text message can crash some unpatched Android phones, matching the proposed event. Межа and The 420.in also describe the exploit, but Межа identifies BleepingComputer as its source and The 420.in appears to repeat the same reporting.