The message doesn’t appear in the inbox, it doesn’t make the phone ring and it doesn’t ask to be opened, it just needs to arrive (and it doesn’t even have fraudulent objectives: it’s not used to steal data, but only to sabotage phones). Is called SMS of Death and it is an Android vulnerabilitycataloged as CVE-2026-58882. A security researcher made it public in late October, along with a demo app posted on GitHub.
How it works
The defect concerns i WAP Push messagesservice SMS that the system processes itself. A malformed packet of just eight bytes crashes com.android.phone, the process that manages the cellular network. The signal skips for a couple of seconds and the call in progress drops, including the one to the emergency numbers. . With around twenty messages, according to the researcher’s tests reported by BleepingComputer, the phone can end up in a cycle of continuous reboots. A factory data reset was needed on a device with Android 12. The phone is not “destroyed forever”, therefore: the real damage is the loss of what was not saved elsewhere. There is also a procedure via ADB, from a computer, to delete the offending messages, even if it is not within everyone’s reach.
Who takes risks
More than the model Android version matters. Google classified the flaw as critical in its November security bulletin, with fixes for Android 14, 15, 16 and 17. The change to the code, according to the researcher, had already arrived with the October updates. However, the official reference remains a security patch dated November 1, 2026 or later, which can be read in the phone’s settings (the path changes from brand to brand). They remain Android 12 and 13 are heavily exposedexcluded from the correction. In case you have a smartphone that works very well, but no longer receives updates, you will have to resign yourself, because at least for now there is no official remedy.
