A manipulated text message makes ongoing calls drop, disclosed on 29 October 2026 – Android 12 and 13 remain without a fix
Key points
- A single crafted text message crashes the phone module of Android smartphones without any action by the recipient and cuts ongoing calls, including emergency calls.
- According to the security researcher, Android 12 to 17 are affected; Google closed the flaw in the October 2026 security update, but only for Android 14 to 17.
- There is still no official patch for Android 12 and 13, even though the same faulty code runs there.
A single text message can paralyse an Android smartphone and cut ongoing calls, without the person affected doing anything. Security researcher Mark B. calls the flaw “SMS of Death”.
The message arrives silently. Those affected usually see no text message in their inbox, no notification, no indication of a sender – only a call that ends abruptly or a phone that briefly freezes. Android processes the manipulated message before it even reaches the visible message history.
According to the researcher’s own records, Google was notified of the flaw through its bug bounty programme as early as May 2026 and wrote a correction commit in June. Nevertheless, the vulnerability does not appear under its CVE number in the official Android Security Bulletin for October 2026 – a point the researcher himself also leaves open.
How the attack works technically
The attack exploits an outdated mobile technology called WAP Push – originally intended to allow network operators to send configuration messages to phones. Android processes such messages via the function WapPushOverSms.decodeWapPdu() in the telephony component of the operating system. According to the researcher’s technical analysis, this function reads a length value from the message without checking it sufficiently. With a deliberately malformed message, this value turns negative; Android then tries to create a data array of negative size and crashes with an unhandled exception.
In practice, this means an attacker only needs the target’s phone number and sends the crafted message as a so-called data SMS via port 2948 – without any access to the device itself and without the target having to click on or open anything. The responsible system process com.android.phone crashes and restarts, which according to the researcher takes around one to two seconds. During this time, an ongoing phone call drops – with the internal error code “CS_DEATH”.
Network operators often redeliver undelivered messages automatically. As a result, the crash can repeat itself without another message having to be sent. In the researcher’s tests, this led to intermittent outages of up to a week. Around 20 such messages were enough in his experiments to make a smartphone practically unusable for an extended period, because the faulty message remains in the queue and is processed again on every restart – a restart loop that could easily tempt ordinary users into resetting the device to factory settings.
In his English-language disclosure, the researcher himself sums up the core problem:
“The vulnerability allows a remote attacker to crash a victim’s phone process with just their phone number, no user interaction required.”
Mark B., security researcher, in his full disclosure on smsofdeath.com (29 October 2026)
Which devices and Android versions are affected
According to the disclosure, the faulty code is present in Android 12 to 17 – in other words, in practically every smartphone shipped with Android over the past four years or so. The researcher says he tested the flaw with a reproduction rate of 100 percent on a Google Pixel 9 running the April 2026 firmware and on various devices from the Samsung Galaxy and Galaxy A series.
In Germany, too, Android is by far the most widely used smartphone operating system. The flaw therefore does not affect niche devices but a large share of the smartphones used in Germany, regardless of manufacturer – provided the respective Android release falls within the affected version range.
| Android version | Faulty code present | Patch in October 2026 update |
|---|---|---|
| Android 12 / 12L | yes | no |
| Android 13 | yes | no |
| Android 14 | yes | yes |
| Android 15 | yes | yes |
| Android 16 / 16 QPR2 | yes | yes |
| Android 17 | yes | yes |
Source: disclosure by security researcher Mark B., smsofdeath.com, as of 29 October 2026. Whether and when older, no longer supported devices will receive a fix is unclear.
What Google has done so far
According to the researcher’s disclosure, he submitted the bug on 5 May 2026 via the Android & Devices Vulnerability Rewards Program, Google’s own bug bounty programme for the operating system. A correction commit titled “Fix remote DoS in decodeWapPdu” was written on 15 June 2026, according to the source code records he reviewed, and was eventually shipped with the Android security update in October 2026.
The fix actually implemented differs from the solution the researcher himself had proposed. While he had suggested checking the length value, Google’s solution catches the exception that occurs and then deletes the triggering message from the device’s SMS database.
It remains unclear when, or whether, Android 12 and 13 will receive a fix. According to the disclosure, both versions rely on the same faulty code as the patched newer versions but were not included in the October update. For devices that no longer receive security updates anyway, the researcher currently names no official remedy.
The open question in the official bulletin
A look at the official Android Security Bulletin for October 2026 raises a question that the researcher does not answer either: CVE number 2026-58882, under which the “SMS of Death” flaw is listed there, does not appear in the bulletin itself. Search terms such as “WapPushOverSms” or “decodeWapPdu” cannot be found in the official list either.
Instead, the bulletin lists a different denial-of-service vulnerability rated as high in the system’s telephony component, filed under CVE-2026-58859 and affecting Android 17. Whether this is the same flaw under a different identifier, a related vulnerability fixed separately or merely a documentation error cannot be conclusively determined from the publicly available documents. It was not possible to submit a query to Google before the editorial deadline; in his disclosure, the researcher merely points out that his fix does not appear in the bulletin under the CVE number he used.
What is WAP Push anyway?
WAP Push is a mobile technology in use since the early 2000s, through which network operators automatically send configuration messages – for example for mobile internet or MMS – to phones. The messages are transmitted as special data SMS and processed by the operating system in the background without users ever seeing them.
What those affected can do now
An attack via this flaw leaves no visible traces in the inbox for outsiders, so it cannot be specifically detected. It can still be prevented – above all with an up-to-date security update.
Checklist: check your Android security update
- In the settings under “System” or “Security and privacy”, check whether the October 2026 security update or newer is installed.
- If the update is missing, trigger the automatic installation and then restart the device – the patch only takes full effect after a restart.
- Anyone using a device with Android 12 or 13 will, as things stand, not receive a fix for this specific flaw – a reason to pay attention to the manufacturer’s remaining update commitment when buying a new device.
- If a device restarts repeatedly or gets stuck in a recovery loop: do not hastily choose “Wipe data” or a factory reset. The researcher describes a technical method via the Android Debug Bridge (ADB) that removes the blocking message without losing data – however, this requires a computer and basic technical knowledge.
If in doubt, users with acute problems can contact the customer service of their smartphone manufacturer or mobile provider.
Frequently asked questions
Do I have to click on something or open an app to be affected?
No. According to the researcher, the attack works entirely without any action on the device – it is enough for the phone number to be known. The message is processed in the background before it would appear in the visible message history.
How can I tell whether my smartphone was affected?
A typical sign is a phone call that suddenly drops, followed by a brief freeze or restart of the device. According to the disclosure, there is usually no conspicuous text message in the inbox, as the message is processed before it is displayed and is deleted automatically once the patch has been applied.
Does a virus scanner protect against this flaw?
The disclosure says nothing about this. As the bug lies deep in the telephony component of the operating system and is not triggered via an installed app, it is unclear whether common security apps can detect the attack at all. The official security update from Google or the device manufacturer remains the only protection confirmed by Google.
Are there already reports of actual attacks?
Not according to the information publicly available so far. What has been described to date is the reproduction of the vulnerability under test conditions and its possible consequences, not any known cases of attacks outside controlled tests.
How do you handle security updates on your smartphone – promptly or do you tend to put them off? Feel free to share your opinion in the comments.
Sources and status
- Mark B.: Full disclosure “SMS of Death” (CVE-2026-58882), smsofdeath.com, published 29 October 2026
- Mark B.: Proof-of-concept repository on GitHub
- Android Open Source Project: Android Security Bulletin, October 2026
Research and data as of: 31 October 2026.
Transparency notice: AI-assisted tools were used in the research, structuring and writing of this article. The sources used are listed in the article. Publication only takes place after manual editorial approval.
