CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Android telephony WapPushOverSms decodeWapPdu remote denial of service (SMS of Death), fixed at the 2026-11-01 patch level

cve · CVE-2026-58882 single-source

Coverage
1
first 2026-11-02 → last 2026-11-08
Latest activity
2026-11-08
Android 'SMS of Death': one hidden SMS drops calls, emergency calls included; Android 12 and 13 get no fix
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector
Sources cited
4
4 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-58882, newest first. Check the date before acting on an older one.

  • Move every managed Android phone below the 2026-11-01 security patch level to that level or later, phones of emergency-service and on-call staff first.
    2026-11-02CVE-2026-58882

Defender insights

What each entry about CVE-2026-58882 tells a defender to do, newest first.

2026-11-02NOTABLEAndroid 'SMS of Death': one hidden SMS drops calls, emergency calls included; Android 12 and 13 get no fix

Exposure · triage · detection

Story timeline

  1. 2026-11-02Android telephony ('SMS of Death'): one hidden WAP Push message crashes the phone process and drops calls, emergency calls included; fixed for Android 14 to 17 at the 2026-11-01 security patch level per Google's bulletin row for CVE-2026-58882, the identifier BleepingComputer gives; Android 12 and 13 stay exposed, public proof of concept
    trending-vulnerabilitiesAndroid 'SMS of Death': one hidden SMS drops calls, emergency calls included; Android 12 and 13 get no fix

Hunting pivots

Affected products
Google Android
Tags
dosmobilepatch-availablepoc-publicvulnerabilitieszero-click
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • ImpactEndpoint Denial of Service: Application or System Exploitation

Impact TA0040

T1499.004Endpoint Denial of Service: Application or System Exploitation×1

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.

Evidence: 2026-11-02/android-sms-of-death-wap-push-telephony-crash · ATT&CK page ↗

Entries about Android telephony WapPushOverSms decodeWapPdu remote denial of service (SMS of Death), fixed at the 2026-11-01 patch level (1)

2026-11-02 · view entry permalink →

NOTABLECVE-2026-58882updatedNATOB2

Android telephony ('SMS of Death'): one hidden WAP Push message crashes the phone process and drops calls, emergency calls included; fixed for Android 14 to 17 at the 2026-11-01 security patch level per Google's bulletin row for CVE-2026-58882, the identifier BleepingComputer gives; Android 12 and 13 stay exposed, public proof of concept

A researcher who signs as Mark B published a working proof-of-concept app on 2026-10-29 for a zero-click remote denial of service in Android's telephony framework (smsofdeath.com, 2026-10-29). One malformed WAP Push data message to port 2948 makes WapPushOverSms.decodeWapPdu() cast a 64-bit header length to a signed 32-bit integer and allocate a negative-sized array; the uncaught NegativeArraySizeException kills the com.android.phone process, which drops active calls, emergency calls included, and cuts service for one to two seconds per message (smsofdeath.com, 2026-10-29). The poison message stays in the pending queue and is retried on every boot and on carrier redelivery: the researcher reports that about 20 messages leave a device unusable and that one Android 12 phone rebooted into recovery roughly every 90 seconds until the messages were deleted over ADB (smsofdeath.com, 2026-10-29). The crash reproduced on Android 12 to 16, on a Pixel 9 and on Samsung Galaxy and A-series phones (smsofdeath.com, 2026-10-29); Security Affairs restates the mechanism and the October fix for Android 14 to 17 (Security Affairs, 2026-11-01).

Google's fix, titled "Fix remote DoS in decodeWapPdu", catches the exceptions the malformed messages trigger and deletes the malicious messages from the SMS database (BleepingComputer, 2026-10-31); per the researcher it shipped in the October 2026 update for Android 14 to 17, so Android 12 and 13 phones outside the update window run the same code unfixed (smsofdeath.com, 2026-10-29). Google's November 2026 bulletin lists CVE-2026-58882, the identifier BleepingComputer gives, as a critical denial of service in the System component fixed at the 2026-11-01 security patch level for Android 14, 15, 16, 16-qpr2 and 17 (Google, 2026-11-02; BleepingComputer, 2026-10-31). BleepingComputer adds that the fix is not listed in Google's October bulletin (BleepingComputer, 2026-10-31). The proof-of-concept app and its source are public (smsofdeath.com, 2026-10-29; BleepingComputer, 2026-10-31), and none of the sources reports use in the wild.

Triage: a single telephony restart has many benign causes; a restart that recurs on every boot or on each carrier redelivery, with the exception above in the crash log, matches this flaw.

The message is delivered as a data SMS and is never shown to the user: there is nothing in the inbox, and the victim never sees the sender's number.

Devices updated to the October 2026 patch level or later are protected; devices on earlier patch levels remain vulnerable.

Mark B (smsofdeath.com) 2026-10-29

the flaw is not listed in Google's October security bulletin, and older Android 12 and 13 devices remain vulnerable because they did not receive the fix.

BleepingComputer 2026-10-31
Updaterun 2026-11-08T1309Z-auditactionsbodycvessourcessourcing_notesummarytitle

Google's Android Security Bulletin for November 2026, published on 2026-11-02, lists CVE-2026-58882 in the System component as a critical denial of service with updated AOSP versions 14, 15, 16, 16-qpr2 and 17, fixed at the 2026-11-01 security patch level (Google, 2026-11-02). BleepingComputer gives CVE-2026-58882 as the identifier of the SMS of Death flaw (BleepingComputer, 2026-10-31). On BleepingComputer's identifier, the vendor-stated fix level is 2026-11-01, a month later than the October update the researcher names; handsets on the October level are not covered by Google's statement. Android 12 and 13 do not appear among the updated versions (Google, 2026-11-02).

vulnerability02 Nov 03:46Zsingle-sourceOpen finding →
Sources: Mark B (smsofdeath.com) · BleepingComputer · Security Affairs · Google (Android Security Bulletin, November 2026)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (25%)
  • securityaffairs.com1 (25%)
  • smsofdeath.com1 (25%)
  • source.android.com1 (25%)

External references

NVD · cve.org · CISA KEV

All cited sources (4)