Android 'SMS of Death' Flaw Can Drop Calls With One Invisible Text

Researcher Mark Blaszczyk has published a working exploit for CVE-2026-58882, a vulnerability in Android's phone process. An 8-byte malformed WAP Push message sent to port 2948 can crash the process, dropping active calls, including emergency calls. No clicks are required and the recipient never sees the message, and around 20 such messages can trap a phone in a reboot loop. The flaw dates back to Android 12, but Google's fix in October updates covers only Android 14 through 17, leaving Android 12 and 13 unpatched. No in-the-wild attacks have been confirmed, and the issue causes loss of availability rather than data theft. Users are advised to install the latest security update, as there is no setting that blocks WAP Push messages.