The SMS of Death vulnerability on Android crashes the call service with a specially crafted message. Google's patch will go into the November newsletter.
The SMS of Death vulnerability on Android can crash the phone's call service with a single message. Moreover, the user does not need to do anything. Thus, the attacker can disable the device remotely, without the victim even knowing.
Think of it this way: You call 911 and the call suddenly drops. Moreover, there was no signal and you did not press any buttons. However, a message coming in the background may have crashed the search service.
How Does SMS of Death Work?
Security researcher Mark Blaszczyk discovered the vulnerability. The attack relies on a specially crafted message that Android has difficulty processing. However, this message does not appear in the inbox. That's why you won't see any suspicious notifications or a sender you don't recognize.
The message crashes the system that handles calls. The ongoing negotiations break off immediately; Moreover, calls made to emergency services are also affected. But this is not the main problem, because Android can try to process the same message over and over again.
According to Blaszczyk, approximately 20 messages can render the phone almost unusable. The device can also enter a bootloop, a loop that constantly restarts. Moreover, if the operator sends the same messages again, even resetting to factory settings may not be a permanent solution.
To save the phone from resetting, it may be necessary to connect the device to the computer and clear the messages manually. However, for an ordinary user, this is not a realistic way. Therefore, the problem is quite serious for those who do not have technical knowledge.
Which Devices Are Affected?
The researcher successfully reproduced the SMS of Death attack on Google Pixel and Samsung Galaxy devices. The code that caused the vulnerability dates back to Android 12. But the risk depends on whether the device receives the fix or not. For this reason, older Android versions that do not receive security updates may remain vulnerable.
When Will Google's Patch Come?
Blaszczyk notified Google on May 5. However, the company has repeatedly dismissed the report as not having a security problem. That's why the researcher publicly announced the vulnerability on October 29 and published a working demonstration.
However, Google was working on a solution at this time. According to Android code logs, the fix was ready on June 15. Additionally, the new software manages the error and deletes the problematic message before it causes further damage. On the other hand, GrapheneOS stated that the fix for X was distributed via security previews in July.
The vulnerability is tracked under the code CVE-2026-58882 and has a Critical severity rating. The fix is also expected to be included in the November Android Security Bulletin. However, Google has not yet explained the contradiction. A breakdown in internal communication, or even a duplicate report, could be the cause.
According to Blaszczyk, Google added the fix in the October updates for Android versions 14 through 17. On the other hand, GrapheneOS says that the vulnerability will be included in the November bulletin and states that it received the fix with July previews. However, these two calendars do not have to conflict. Because manufacturers can receive corrections before the public release.
The timeline for the fix to reach individual devices is unclear. Therefore, the safest step is to install the latest security update available for your phone. The vulnerability is expected to be officially listed in the November Android Security Bulletin.
