Security researcher Mark B disclosed an Android vulnerability on Oct. 29 and named it "SMS of Death." According to the disclosure, a phone only needs to receive one specially crafted text message for its calling function to fail, cutting off active calls and potentially affecting emergency calls as well.
The message does not require the victim to open anything. It also does not appear in the inbox, and the sender's number is not visible.
Google's October patch list covered Android 14 through 17
The report said Android 14 to 17 were patched in the October 2026 security update. In Google's October Android security bulletin, the listed fixes were marked only for Android 14 through 17, with Android 12 and 13 absent from that range.
WAP Push handling was cited as the trigger
Text messages are used not only for ordinary messaging but also by carriers and system services to deliver information. Android includes a feature that handles a special class of messages known as WAP Push, and those messages are processed automatically without user action.
The researcher said the feature did not sufficiently validate data length while parsing the message. When it encountered a specific value, it failed and caused the system service responsible for calling to terminate unexpectedly. GIGAZINE said these messages do not show up in standard messaging apps, making the attack difficult for users to notice.
One message could keep causing disruptions for up to a week
Each time Android receives one of these malicious messages, the calling function can stop working for about 1 to 2 seconds, dropping any ongoing call, according to the researcher. Because the phone fails before it can send back a delivery acknowledgment, the carrier retries the message, which causes the failure to repeat.
In the researcher's testing, intermittent call disruption caused by a single message lasted as long as one week. If about 20 such messages were sent, the phone could remain unusable for a long period. The messages stay pending for delivery, and even after a reboot, the calling service may continue to crash repeatedly.
The researcher tested the issue on a Google Pixel 9 and multiple Samsung Galaxy models, and said every tested device reproduced the problem.
Reported in May, but timelines differ
The researcher said he reported the bug to Google on May 5, 2026. GIGAZINE said a fix was recorded in the Android Open Source Project on June 15 and was later included in the October security update. After the fix, a parsing error no longer stops the calling service, and the problematic message record is deleted.
GrapheneOS, an Android-derived system focused on privacy and security, presented a different timeline on Hacker News and X. GrapheneOS said Google's fix had already been sent to device makers through a security preview in mid-July, and that GrapheneOS itself shipped the fix in July in its own security preview release.
GrapheneOS identified the bug as CVE-2026-58882
GrapheneOS also said the vulnerability is tracked as CVE-2026-58882 and will be rated "critical" in the upcoming November security bulletin. That identifier did not appear in Google's October bulletin, which was published on Oct. 5 and updated on Oct. 8.
There were also differing views on Hacker News over how Google classified the issue. The researcher wrote that Google decided a temporary denial-of-service condition did not qualify and did not investigate further. He also said the flaw was in Android itself, while carriers only delivered the messages.
As of now, Google, carriers, and phone makers have not made public statements about the vulnerability.
Users were advised to check patch levels
GIGAZINE noted that security update rollout schedules vary by device maker, so users need to verify the current security patch level on their phones.
Key disclosed details
- One specially crafted message can disable Android calling for about 1 to 2 seconds and drop calls.
- In testing, intermittent disruption from a single message lasted up to one week.
- Roughly 20 messages could leave a phone unusable for an extended period.
- Google's October bulletin listed fixes for Android 14 through 17, but not Android 12 or 13.
