ROHAN TECH OFFICIAL • Technology • AI • Apps • Tutorialsinfo@rohantechofficial.com
ROHAN TECH OFFICIALTechnology • AI • Apps • Tutorials • Digital World
Home → Tech News → Android “SMS of Death”: One Invisible Text Can Crash Your Calls

Android “SMS of Death”: One Invisible Text Can Crash Your Calls

By Rohan Jaspal • November 1, 2026 • Updated November 1, 2026
Android “SMS of Death”: One Invisible Text Can Crash Your Calls

It sounds like an urban legend: a single text message you never see crashes your phone and drops your calls — including calls to emergency services. But security researcher Mark Blaszczyk has published a working exploit proving it’s real. Tracked as CVE-2026-58882 and dubbed the “SMS of Death,” it’s a zero-click Android flaw, and all it takes is one malformed message.

How an invisible text breaks your phone

The trick abuses WAP Push — an old SMS format that networks still use behind the scenes for things like MMS notifications and carrier settings. Unlike normal texts, WAP Push messages get processed by Android automatically, before they ever reach your inbox. You see nothing. There’s no warning and no trace.

Blaszczyk found that an eight-byte malformed message, sent as a data SMS to port 2948, trips a bug in Android’s WAP Push decoder: it reads a header-length value that becomes a negative number, then tries to allocate memory of that negative size. The resulting crash kills com.android.phone — the system process that manages calls and cellular connectivity. Your active call drops instantly. The phone loses mobile service for a few seconds while Android restarts the process.

And it scales: in testing, around 20 malicious messages left phones stuck in reboot loops, one test device restarting into recovery roughly every 90 seconds until it was factory-reset.

Who’s affected — and the fix

The vulnerable code dates back to Android 12, and Blaszczyk reproduced the crash every time on a Pixel 9 and several Samsung Galaxy phones. Here’s the uncomfortable part: Google’s fix shipped in the October 2026 security updates for Android 14 through 17 only. Android 12 and 13 devices didn’t get it. The flaw also didn’t appear in Google’s October security bulletin; it’s reportedly scheduled for November’s.

Blaszczyk reported the issue to Google back in May 2026 — it was first classified as a non-security issue before engineers built the fix. There are no confirmed attacks in the wild so far, and the research shows a loss of availability, not a data breach: nothing suggests it can steal your data or take over your phone.

What you should do

There’s no setting that blocks WAP Push messages, so the only real protection is installing your phone’s latest security update. Check now: open Settings, look for the security update option (the exact path varies by brand), and install anything pending. If you’re on Android 14 or newer and haven’t installed October’s update, do it today. On Android 12 or 13 with no update in sight, your best defense is knowing the risk — and maybe thinking about that upgrade sooner than planned.

Outbound links:

Internal links: