Android SMS of Death vulnerability: one invisible text can crash your team’s phones
A technician is on the road, on a call with a client. The call drops, the phone restarts, then does it again a few minutes later. No suspicious app, no clicked link, no visible message in the inbox. The cause: a single invisible text message.
On October 31, 2026, BleepingComputer reported that exploit code had been published for an Android flaw nicknamed “SMS of Death” (CVE-2026-58882). Here is what it does, which phones are affected and how to check your team’s devices.
Android SMS of Death vulnerability: what happens
Researcher Mark Blah published the technical analysis: a poorly validated length value in the handling of “WAP Push” messages crashes the process that runs the phone’s cellular functions. The result: loss of mobile service and dropped calls, including emergency calls. Because the message never shows on screen, the user can’t see where the problem comes from.
On one Android 12 device tested, the phone rebooted into recovery mode about every 90 seconds and had to be factory reset. A contributor found a clean-up method using ADB, but it requires a computer and technical know-how.
Which phones are affected
| Android version | Status according to the researcher | Action |
|---|---|---|
| Android 14, 15, 16 and 17 | Fixed in the October 2026 security updates | Install the October 2026 update or later, then restart |
| Android 12 and 13 | No fix | Plan to replace the device |
An important nuance: the flaw is not listed in Google’s October Android security bulletin. Update availability also depends on the manufacturer (Samsung, Motorola, Google Pixel, etc.) and the carrier. This is a denial of service: the flaw crashes the phone, it does not give access to data. But for a team that depends on its phones, that’s already a lot.
Check a phone in 1 minute
On each company Android phone
- ☐ Open Settings › About phone and note the Android version.
- ☐ Open Settings › Security (or “Security & privacy”) and read the security patch date: it should be October 2026 or later.
- ☐ Check for system updates, install, then restart.
- ☐ If the version is Android 13 or older: add the device to the replacement list.
What an SMB should do this week
- Take an inventory of the Android phones used for work, including personal devices that receive company email or calls.
- Require a minimum patch date in your mobile device management tool (Intune or other): a phone that is too old no longer gets access to company data.
- Have a plan B for employees who work alone or on the road: another way to reach the office if the phone goes down.
- Budget for replacing devices that no longer get updates. Same logic as for your computers: a device without patches stays exposed to the next flaws.
For another recent flaw affecting phones, see our article on the Signal vulnerability.
How NeoTech can help
Our cybersecurity services include an inventory of your mobile devices, compliance rules in Intune and a replacement plan for devices that are too old. Our automated 24/7 monitoring with on-call technician intervention covers monitored workstations and servers.
Book your free cyber check
In 30 minutes, we look together at which of your team’s devices no longer get updates and how to manage them.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- BleepingComputer — New Android SMS of Death exploit can remotely crash unpatched phones, October 31, 2026
- Google — Android Security Bulletins
Photo: Ron Lach, Pexels (Pexels licence).