Android SMS of Death (CVE-2026-58882): update your phone, then check the patch date

Updated November 3, 2026: Google’s November 2026 Android Security Bulletin now lists CVE-2026-58882 as a Critical denial-of-service fix at patch level 2026-11-01. Aim for 2026-11-01 or later on your phone; 2026-11-05 is ideal.

A crafted text that never lands in your inbox can still knock cellular service off your Android phone. That is the practical takeaway from CVE-2026-58882, nicknamed SMS of Death. Reporting that began on October 31, 2026 (BleepingComputer, with follow-ups from Root2Sec and Mallory) describes a zero-click denial-of-service path against Android telephony.

This is not ransomware. It is not a silent theft of your photos. It is a crash of the phone process that handles calls and cellular connectivity. That still matters when you need to place or keep a call, including an emergency call.

This is a different story from Google’s monthly Android October 2026 security bulletin write-up. That piece was about patch level 2026-10-01. This one is about a single named bug with public attack code and a short checklist for your own phone.

What the bug does

According to the researcher’s analysis as reported by BleepingComputer:

• The target path is Android’s WAP Push handling (WapPushOverSms.decodeWapPdu), which processes a binary SMS before anything shows in the regular inbox.
• A malformed header-length value can become a negative number when cast to a signed 32-bit integer. Allocating memory with that size throws a NegativeArraySizeException that crashes com.android.phone, the process that runs calls and cellular service.
• No tap is required. Android processes the message before it reaches the inbox, so there is nothing visible to warn you.
• Each crash drops cellular service and can end a call in progress, including an emergency call. Stored or redelivered messages can make the crash repeat. In testing, 20 malicious messages left some phones stuck in reboot loops, and one Android 12 phone needed a factory reset to recover.

BleepingComputer credits researcher Mark Blah for the technical analysis and notes that a proof-of-concept that can send the malicious messages from another Android device is public. Treat that as a reason to patch sooner.

What Google and phone makers have said

• Google’s November 2026 Android Security Bulletin, published November 2, 2026, lists CVE-2026-58882 in its System table as a Critical denial-of-service fix at patch level 2026-11-01, for Android 14, 15, 16, 16 QPR2, and 17. Patch level 2026-11-05 includes everything at 2026-11-01, so either November date covers it.
• Before the bulletin, the researcher said (as reported by BleepingComputer) that the fix, titled “Fix remote DoS in decodeWapPdu”, catches the error and deletes the bad messages so they do not keep crashing the phone.
• The researcher says Android 12 and 13 phones did not get the fix and remain exposed. An old phone that stopped getting monthly security updates is the highest residual risk.

Your phone maker (Pixel, Samsung, Motorola, and the rest) still has to deliver the update. Google’s fix only helps once your brand ships it to your model.

How to update and verify on your own phone

Exact menus vary. The habit does not.

1. Connect to Wi-Fi and plug in, or make sure the battery is well charged.
2. Open Settings and find system updates:
   • Pixel: Settings > System > Software updates > System update.
   • Samsung Galaxy: Settings > Software update > Download and install.
   • Other brands: search Settings for “software update” or “system update.”
3. Install everything offered. Restart when asked. Do not leave the update half-applied overnight.
4. After restart, open Settings > About phone (sometimes under System) and read the Android security update / security patch level date.
5. Aim for November 1, 2026 / 2026-11-01 or a later date. 2026-11-05 is ideal. If you are still on October 2026 or older, you do not have the fix listed in Google’s bulletin.
6. Repeat on every Android phone or tablet in the house that has a SIM card, including older hand-me-down phones.

If Settings says the system is up to date but the patch date is still October or older, your manufacturer has not shipped the November package to that model or carrier yet. Check again in a few days. Do not sideload random “SMS of Death fix” ZIP files from forums.

Also update the Phone, Messages, and carrier services apps from Google Play or your phone maker’s app store when updates appear. Those are not a full substitute for the security patch level date, but they are still worth keeping current.

If the phone is already crash-looping

Most people will never see this. If you do:

• Try a normal restart first.
• If cellular service keeps dropping right after the phone starts, removing the stuck messages may require a computer and Android Debug Bridge (ADB). A GitHub contributor published that method; it is a technical fix, not a Settings option. Ask someone comfortable with it, or contact your phone maker or carrier.
• A factory reset is a last resort. It does not fix the bug, so an unpatched phone can crash again if it gets another bad message. Install the update as soon as the phone stays up long enough.

Do this / don’t do that

Do

• Install the latest system security update your phone offers, restart, and read the security patch level date yourself.
• Help relatives on Android 12 or 13 check whether updates still exist. If they do not, plan a replacement.
• Keep automatic updates on, and still check the patch date after news like this.

Don’t

• Do not assume “up to date” means you have November 2026 without reading the date.
• Do not flash unofficial firmware to force a CVE fix early.
• Do not ignore a phone that stopped getting monthly patches years ago. It is time to replace it.
• Do not test proof-of-concept SMS tools against anyone’s phone. It can knock out their calls, including emergency calls.

Bottom line

CVE-2026-58882 is a zero-click Android telephony crash triggered by a malformed WAP Push SMS (BleepingComputer). Google’s November 2026 Android Security Bulletin lists it as a Critical denial-of-service fix at patch level 2026-11-01. On your own phone: install the latest system update, restart, confirm security patch level 2026-11-01 or later (2026-11-05 is ideal), and plan to replace Android 12 or 13 phones that no longer get updates.

Image: Official Android logo from android.com.