Android SMS of Death exploit crashes unpatched phones
The gist
Security researcher Mark Blah published a proof-of-concept exploit for an Android flaw that crashes phones via a malformed text message.
Older Android 12 and 13 devices reportedly remain unpatched, so the public exploit code raises the risk.
How it unfolded
- Oct 2026Mark Blah disclosed CVE-2026-58882, a zero-click denial-of-service flaw in Android's WapPushOverSms.decodeWapPdu function, dubbed 'SMS of Death'.
- Oct 2026Google reportedly patched the vulnerability in its October 2026 Android security updates for Android 14 through 17, but the flaw is not listed in Google's October security bulletin.
- Oct 31, 2026BleepingComputer reported that Blah published a proof-of-concept exploit that can send the malicious messages from another Android device; the code is public on GitHub.