Researcher Mark B (GitHub: MarkBlah) published a write-up on 29 October 2026 at smsofdeath.com of 'SMS of Death', a zero-click remote denial-of-service flaw in Android's telephony framework (WapPushOverSms, frameworks/opt/telephony).

The researcher says WapPushOverSms.decodeWapPdu() reads a WAP Push header length, casts it to a signed 32-bit integer with no range check and uses it as an array size, so an eight-byte message (01 06 88 80 80 80 00 BE) sent as a data SMS to port 2948 throws an uncaught NegativeArraySizeException that kills com.android.phone. Per the researcher, the message never appears in the inbox, active calls drop (including emergency calls), each message causes 1-2 seconds without service, carrier redelivery re-crashes the phone, about 20 messages can make a device unusable for an extended period, and the queued message can crash the phone on every boot; on an Android 12 test device this produced a reboot into recovery roughly every 90 seconds.

The researcher says the crash was reproduced from Android 12 up to Android 16 on Pixel and Samsung Galaxy devices, that it was reported to Google on 5 May 2026, and that Google's fix (commit 735d967, 'Fix remote DoS in decodeWapPdu', authored 15 June 2026) catches the exception and deletes the triggering message; it shipped in the October 2026 Android security release for Android 14 through 17, so Android 12 and 13 devices do not receive it. A recovery method over ADB (deleting the queued rows from content://sms/raw), credited to @sakisdog, is on the site.

The researcher has published a working proof-of-concept app and source on GitHub. BleepingComputer reported on 31 October (11:35 pm Perth) that the flaw is tracked as CVE-2026-58882 and is not listed in Google's October 2026 Android security bulletin; the bulletin, read by this desk, does not list CVE-2026-58882. (sources: smsofdeath.com; GitHub MarkBlah/smsofdeath; BleepingComputer)