What is the SMS of Death vulnerability?
Security researcher Mark Blaszczyk identified a critical flaw in Android that can be triggered by a specially crafted WAP push text message. The flaw, catalogued as CVE-2026-58882, has been nicknamed the SMS of Death because the message never appears in the user’s inbox yet forces the device to crash.
How the exploit works
The attacker sends a WAP push SMS that contains malformed data. Android processes the message at the system level, causing the telephony service process to terminate. Because the message is invisible, the victim does not need to tap, open, or even notice a notification. The crash leads to a restart loop where the phone repeatedly reboots and eventually prompts the user to perform a factory reset, wiping all personal data.
Multiple messages amplify the problem. Network operators often resend unconfirmed messages, meaning a single malicious SMS can cause intermittent outages for days, and around twenty messages can render a device unusable for an extended period. The faulty message remains in the system queue and is retried on every boot, creating a persistent denial‑of‑service condition.
Devices at risk
The vulnerability is present in Android versions from 12 through the latest Android 17. That means flagship devices such as Samsung Galaxy S25, Google Pixel 8 Pro, OnePlus 12, Xiaomi Mi 14 and Motorola Edge 40 are all potentially vulnerable if they run an affected Android build. Even users who keep their phones up to date may be exposed because the bug survives in the newest releases.
Google’s response and patches
Google has acknowledged the issue and is rolling out a security patch that spans Android 14 to Android 17. The patch distribution depends on the device manufacturer, so Samsung, Google, OnePlus and other OEMs will release their own updates tailored to each handset. Unfortunately, the fix is not expected for older releases such as Android 12 and Android 13, leaving devices on those versions at continued risk.
What users can do
If a phone enters recovery mode after receiving the invisible SMS, do not immediately tap the wipe data option. Instead, power off the device and seek assistance from an Android specialist. The problematic message can be removed using the Android Debug Bridge (ADB) tool while the phone is connected to a computer via USB. This method requires technical knowledge but avoids a full factory reset and preserves user data.
In the meantime, users should keep their devices backed up, install security updates as soon as they become available, and consider disabling WAP push messages if the option exists in the carrier settings. Staying informed about emerging threats and applying patches promptly remains the best defense against zero‑click attacks like the SMS of Death.