Loading vulnerability…
SMS of Death
CVE-2026-58882, known as “SMS of Death,” is a persistent, zero-click denial-of-service vulnerability reportedly affecting Android 12 through 17. An unchecked numeric type conversion during WAP-Push WSP-header processing turns an attacker-controlled length value into a negative array size. The resulting unhandled NegativeArraySizeException crashes the Android telephony service. A single malformed SMS can trigger the vulnerability without appearing in the recipient’s inbox. Reprocessing the message after restarts and carrier redelivery of unacknowledged messages can sustain telephony failures and recurring device reboots.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can interrupt active calls, including emergency calls, and cause repeated device restarts approximately every 90 seconds. Persistent reprocessing and carrier redelivery can leave affected devices practically unusable; testing reportedly demonstrated disruption lasting up to one week from a single malicious SMS. Recovery may require ADB-assisted intervention or a factory reset that erases user data. The vulnerability does not establish arbitrary code execution or access to sensitive data.
If you can’t patch tonight, do this now.
For an already affected device, recovery without erasing user data reportedly requires connecting it to a computer and using Android Debug Bridge; specific recovery commands and prerequisites are not available. A factory reset is a destructive recovery option that erases user data. These recovery measures do not patch the vulnerability, and carrier redelivery of unacknowledged malicious messages can prolong disruption. No verified preventive workaround is specified.
Patch, then assume compromise.
Install a vendor update that explicitly incorporates the fix for CVE-2026-58882. Google reportedly supplied an October 2026 patch for Android 14 through 17, with device availability dependent on manufacturer distribution. GrapheneOS incorporated the fix in July 2026. Android 12 and 13 require manufacturer-provided fixes because they no longer receive Google support; where no fix is available, migrate to a supported, patched operating system or device.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.