By the Smili Phone team
A single hidden text message can knock an Android phone off its calls. No tap, no link, no download. Security researcher Mark Blaszczyk published the attack on October 29, 2026, under the name SMS of Death, and it is tracked as CVE-2026-58882 with a Critical rating in the November 2026 Android Security Bulletin.
This is not a scam text trying to trick you into tapping something. It is a flaw in how Android handles a certain kind of background message, and it targets the part of the phone that runs calls.
How one hidden text breaks calls
The attack uses WAP Push, an old type of SMS that networks use to send phones settings and MMS alerts. Your phone handles these messages in the background, so you never see one arrive, and there is no visible sender.
The problem sits in an Android component called WapPushOverSms, which reads these messages. A five byte header value is read as a large number, then squeezed into a smaller signed number without a range check. The result flips to negative 2,147,483,648, and Android tries to set aside a negative amount of memory. That fails, and the Phone service, known as com.android.phone, crashes.
Each crash lasts about one to two seconds while the service restarts, but a call in progress drops, including a call to emergency services. The message can stay in the incoming queue and be processed again, so crashes repeat. The researcher reported intermittent crashes for up to a week after a single message, and said around twenty crafted messages can leave a phone unusable for an extended period. In severe cases the phone can loop during startup, and recovery may need a computer tool called Android Debug Bridge.
Which phones are affected
The vulnerable code appears in Android versions 12 through 17. Testing reported by the researcher reproduced the issue on a Google Pixel 9 and on Samsung Galaxy phones, including A series models.
The fix picture is split by version. According to documentation published by the researcher, Google distributed a fix through the October 2026 security update for Android 14, 15, 16, and 17. Phones on Android 12 and 13 run the same faulty code and are not getting that fix, so older phones that no longer receive updates stay exposed. If your phone is on one of those older versions, this is a good reason to think about your next upgrade, and to keep every update it does still receive installed.
Patch timing varies, because phone makers roll updates out on different schedules. The patch level you can be sure about is the November 2026 update.
What to do now
- Install every system update offered on your phone, and look out for the November 2026 security patch.
- Check your version under Settings, then About phone, and check the security patch level under Settings, then Security.
- Do not try to test this yourself. Updates are the protection.
- If your calls keep dropping for no clear reason, or your phone keeps restarting into recovery, get expert help before wiping it. A reset can hide clues about what went wrong.
If your Android phone is acting strangely or stuck on an old version, bring it by our shop in Escondido. We can check the software version and security patch level, and help you work out the sensible next step.
Related: Your phone's hidden security mode · Scam protection on Android and iOS
