Android vulnerability breaks smartphones via invisible SMS

According to Kod.ru, the attack exploits a service WAP Push SMS that the system parses automatically. The device owner does not see it: the message does not appear in the SMS app, there is no notification, and the sender's number is not displayed. When processing such a message, a system process that is responsible, among other things, for telephone service crashes, cutting off an ongoing call, including emergency calls. According to 3DNews, citing BleepingComputer, the vulnerability has been assigned the identifier CVE-2026-58882, and the crash is caused by an improper header length validation in the WapPushOverSms.decodeWapPdu function, which terminates the com.android.phone process.

After a crash, the process restarts, but according to the researcher, about 20 such messages can trigger a crash loop and effectively disable the device (according to 3DNews, even a single message can do so). The mobile carrier may retry delivering the unprocessed SMS, which is why the issue sometimes persists even after a reboot or a reset. According to 3DNews, messages stored in memory can be deleted manually via the Android Debug Bridge, but this can only be done by technically savvy users.

The researcher reproduced the issue on Google Pixel and Samsung Galaxy devices running Android versions 12–16 and published a proof-of-concept exploit that sends such messages from another Android device. Google prepared a fix back in the summer. Smartphones running Android 12 and 13, which no longer receive security updates, may remain vulnerable.