New Android “SMS of Death” (CVE‑2026‑58882) Remote DoS Exploit Crashes Unpatched Phones
What It Is — A security researcher disclosed a proof‑of‑concept exploit for CVE‑2026‑58882, a zero‑click denial‑of‑service flaw in Android’s WapPushOverSms.decodeWapPdu routine. By sending a specially crafted eight‑byte WAP Push SMS to port 2948, an attacker can trigger a NegativeArraySizeException that crashes the com.android.phone process, cutting cellular service and even emergency calls. The bug is patched in Google’s October 2026 security update for Android 14‑17, but the fix is absent from the public bulletin and older Android 12‑13 devices remain vulnerable. Repeated messages can force phones into reboot loops, requiring a factory reset to recover.
Affected Products – Android 12 and Android 13 devices that have not received the October 2026 security update (Android 14‑17 are patched).
Why It Matters for Trust & Control Assurance – The issue highlights the need for a robust patch‑management control that provides continuous evidence of update compliance across a mobile fleet.
Recommended Actions –
- Inventory all Android devices and verify OS version and security‑patch level.
- Deploy a mobile‑device‑management (MDM) solution that enforces automatic installation of Google’s October 2026 update (or later).
- Monitor device crash logs for
com.android.phonefailures and remediate any out‑of‑date devices promptly. - Test for the presence of CVE‑2026‑58882 using publicly available detection scripts.
Source: BleepingComputer