The newly disclosed SMS of Death exploit allows attackers to remotely crash Android devices by sending a crafted text message. The October 2026 security update patched the flaw for Android 14 through Android 17, while Android 12 and 13 remain unpatched without manual ADB removal.
A remote Android vulnerability tracked as CVE-2026-58882, dubbed the SMS of Death, allows attackers to crash smartphones or disrupt cellular connectivity with a single text message. Security researcher Mark Blah published details on the flaw following the release of a security patch. Because Android processes incoming text messages before delivering them to the SMS inbox, affected phones can crash without showing any incoming message or alert to the user. This crash can sever active phone calls, including calls to emergency services, with no user interaction required.
The attack can trigger repeated failures under specific conditions. When mobile carriers attempt to re-deliver the malformed message, or when Android tries to parse messages already saved on the device, the crash cycle repeats. According to Blah, transmitting 20 malicious messages can force a handset into continuous reboot loops. During testing on an Android 12 phone, the device entered recovery mode roughly every 90 seconds. In that test scenario, restoring normal operation required a complete factory reset.
The October 2026 Android security update addresses the vulnerability across Android 14, Android 15, Android 16, and Android 17. Because the patch targets those specific versions, devices running Android 12 and Android 13 remain exposed. Protection takes effect once the October 2026 security update arrives on an eligible device. While the update has been rolling out for weeks, deployment schedules vary, leaving some phones waiting for firmware updates.
For users needing a fix without an official patch, GitHub contributor Sakis discovered a way to delete the malicious messages using ADB (Android Debug Bridge). Applying this method requires more advanced technical knowledge. Devices gain protection once the October 2026 Android security patch arrives on the hardware. Until that update is installed, phones remain technically vulnerable to the SMS of Death exploit, especially as rollout schedules leave some devices waiting longer for the patch.
Google Pixel Watch 5 (45mm)
Luiza Mosneagu is Reviews Editor at Droid Tools. A psychologist by training and tech writer by passion, she has tested over 60 Android devices since 2020 - always for a minimum of two weeks before writing a word. Her focus is camera quality, everyday usability, and cutting through marketing claims to tell you what a device is actually like to live with.
Leaked live images of the Huawei Pura 90 Plus suggest it will feature the Kirin 9025 chip and HarmonyOS 7.0 ahead of its scheduled October 28 launch.
Early CAD renders suggest the Samsung Galaxy S27 Ultra camera design may switch to a horizontal bar housing larger sensors and improved cooling hardware.
A new Google Wallet Tap to pay setting may let users verify their identity before each purchase while still requiring phones to stay unlocked.
Samsung may use Exynos for the Galaxy S27 Ultra as Qualcomm faces thermal issues ahead of a reported mid-October fix deadline.
The next story loads as you reach the end. You can also load it using the button.
Comments & Discussions
Join the conversation! We use Disqus to handle comments. Click the button below to load the comment section.