// AI threat desk · 2 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesMediumCVECVSS not assigned

Android SMS of Death flaw could crash phones and force reboots

Cybernews said Android’s SMS of Death vulnerability can crash calls, brick phones and force resets on Android 12 through 16. HKCERT published its report on Oct 30, 2026.

· 2 min read
AI-generated image of hands holding a frozen smartphone beside another phone and charging cable.
AI-generated image, not a photo of the event.
Key takeaways
  • Android Authority reported that the researcher reproduced the attack on Google Pixel and Samsung Galaxy devices.

Digital Trends said a security researcher uncovered a vulnerability that allows an attacker to remotely crash a smartphone using a specially crafted text message.

Android Authority reported that malicious text messages can silently crash a phone’s calling service, potentially interrupting emergency calls. Repeated messages can cause persistent crashes and reboot loops, while Blaszczyk said around 20 messages could leave a phone practically unusable.

Android Authority said the vulnerable code dates back to Android 12, with exposure depending on whether a device received the fix. Digital Trends described the issue as a denial-of-service vulnerability rather than an exploit designed to obtain passwords or personal information.

On this page

Specially crafted messages crash Android’s calling system

Android Authority reported that the specially crafted message does not appear in the inbox. It instead crashes the system handling phone calls, so users may not see a notification or sender associated with the message.

Android Authority said repeated messages can cause persistent crashes and reboot loops, making affected devices difficult to recover without technical help.

Google’s October updates cover Android 14 through 17

Blaszczyk said Google included the fix in October’s security updates for Android versions 14 through 17, as reported by Android Authority and Digital Trends.

BleepingComputer reported that the issue is tracked as CVE-2026-58882. Android Authority said it was apparently slated for inclusion in November’s Android Security Bulletin.

Digital Trends said there is no confirmed evidence of attacks targeting Android users. It also reported that Android 12 and 13 phones without ongoing security support remain exposed.

FAQ

What is Android’s SMS of Death vulnerability?

Digital Trends described it as a denial-of-service vulnerability, and BleepingComputer said it is tracked as CVE-2026-58882.

What can an SMS of Death attack do?

Android Authority said it can crash Android’s calling service and potentially interrupt emergency calls. Digital Trends reported that it can disconnect ongoing calls and leave a phone in a reboot loop.

Which Android devices are affected?

Android Authority said the vulnerable code dates back to Android 12 and that the researcher reproduced the attack on Google Pixel and Samsung Galaxy devices. Digital Trends reported that Android 12 and 13 phones without ongoing security support remain exposed.

Has the Android SMS of Death flaw been exploited in the wild?

Digital Trends said there is no confirmed evidence of attacks targeting Android users. It described the issue as a denial-of-service vulnerability rather than an exploit designed to obtain passwords or personal information.

How was the Android SMS of Death flaw fixed?

Blaszczyk said Google included the fix in October security updates for Android versions 14 through 17.

Sources

  1. New Android SMS of Death exploit can remotely crash unpatched phones, HKCERTPrimary
  2. New Android SMS of Death exploit can remotely crash unpatched phones, BleepingComputer
  3. Invisible “SMS of Death” crashes Android phone, traps victim in reboot loop until factory reset, Cybernews
  4. Android's SMS of Death bug can knock out your phone, but a fix is coming soon, Android Authority
  5. Android’s new ‘SMS of Death’ exploit can crash your phone without you doing anything, Digital Trends
  6. This Android SMS Of Death Attack Crashes Phones Without A Single Tap, HotHardware
How we checked this story
ClaimSourceStatus
BleepingComputer reported that the SMS of Death vulnerability is tracked as CVE-2026-58882.BleepingComputerAttributed
Cybernews reported that SMS of Death can crash calls, brick phones and force resets on Android 12 through 16.CybernewsAttributed
Android Authority reported that malicious text messages can silently crash Android’s calling service and potentially interrupt emergency calls.Android AuthorityAttributed
Android Authority reported that repeated messages can cause persistent crashes and reboot loops, making affected devices difficult to recover without technical help.Android AuthorityAttributed
Android Authority reported that the specially crafted message does not appear in the inbox and crashes the system handling phone calls.Android AuthorityAttributed
Android Authority reported that the researcher reproduced the attack on Google Pixel and Samsung Galaxy devices.Android AuthorityAttributed
Android Authority reported that the vulnerable code dates back to Android 12 and that exposure depends on whether a device received the fix.Android AuthorityAttributed
Android Authority reported that GrapheneOS said Google distributed the fix through security previews in July.Android AuthorityAttributed
Android Authority reported that the vulnerability carries a Critical severity rating and was apparently slated for November’s Android Security Bulletin.Android AuthorityAttributed
Android Authority reported that Blaszczyk said Google included the fix in October security updates for Android versions 14 through 17.Blaszczyk, via Android AuthorityAttributed
Digital Trends reported that Android 12 and 13 phones without ongoing security support remain exposed.Digital TrendsAttributed
Digital Trends recommended checking the security patch level and installing the latest available Android update.Digital TrendsAttributed
Digital Trends reported that the vulnerability is a denial-of-service flaw rather than an exploit designed to steal passwords or personal information.Digital TrendsAttributed
Digital Trends reported that there was no confirmed evidence of widespread attacks targeting Android users.Digital TrendsAttributed
HotHardware reported that the Android SMS of Death attack crashes phones without a single tap.HotHardwareAttributed
HKCERT published its report on Oct 30, 2026.HKCERTConfirmed

Could not verify

  • Whether the vulnerability was exploited in the wild is not established.
  • How many Android devices are affected is not established.
  • Whether Google classified the report as a duplicate is not established.
  • Whether all Android 12 and 13 devices remain unpatched is not established.
HKCERTcvegoogle
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok