A security researcher has published a working attack that knocks an Android phone off the mobile network with one text message. The researcher, Mark B, released it on Thursday 29th October 2026 under the name SMS of Death. It’s tracked as CVE-2026-58882 and rated Critical.

You don’t have to tap or open anything. The message never shows up in your inbox, and you never see who sent it. It crashes the part of Android that runs your calls, so any call in progress drops, including a call to 999 or 112. Send about 20 of these messages and the phone can stay unusable for a long time.

Google has a fix for phones on Android 14 and later. Phones on Android 12 and 13 run the same faulty code and aren’t getting it. In October, those two versions made up about a fifth of Android web traffic in Kenya.

The attack uses WAP Push, an old type of SMS that networks use to send phones settings and MMS alerts. Your phone handles them in the background, so all an attacker needs is your number. Mark B says the attack worked every time on a Pixel 9 and on Samsung Galaxy phones, including A-series models.

Each WAP Push message carries a number saying how long the next part is, and Android sets aside that much memory without checking it. The eight-byte attack message sets that number so high that it flips to minus 2,147,483,648 when Android stores it. Android can’t set aside a negative amount of memory, so the Phone service (com.android.phone, which runs calls, mobile signal and SMS) crashes.

It restarts within a second or two, so one message looks like a short drop in signal. The message stays in the queue, though, and Android retries it, and crashes again, every time the phone starts. The network also resends messages the phone never confirmed. In testing, one message caused on-and-off outages for up to a week.

With enough of them, Android’s crash protection, called RescueParty, restarts the phone into recovery mode and offers to wipe it, roughly every 90 seconds, as one user found on an Android 12 phone. Getting out without losing your data means deleting the stuck messages from a computer with ADB, Android’s developer tool, in the short window after each restart. Otherwise it’s a factory reset.

We checked Android’s public code ourselves. The faulty line is in every version from Android 12 to 16, and in the code Android 17 first shipped with. Android 17 is affected too, even though the crash was only reproduced up to Android 16.

A Google engineer wrote the fix on 15th June 2026, and it was added to Android’s security code in August. With it, Android catches the crash and deletes the bad message, so it can’t come back after a restart. The fix is on Google’s security branches for Android 14 to 17. The Android 13 branch and the Android 12 one still have the old code, and Google’s October 2026 bulletin only lists fixes for Android 14 and later.

Which update brings the fix to your phone is less clear. Mark B says it’s in Google’s October update, but the October bulletin doesn’t list CVE-2026-58882, and neither does Samsung’s October list. GrapheneOS, a privacy-focused version of Android for Pixel phones, says it’s in Google’s November bulletin, which isn’t out yet. Google tells phone makers about fixes at least a month before each bulletin, so a phone on the October patch may already be protected. Until Google says, the patch level you can be sure of is November 2026.

On most Android phones, Settings > About phone shows your Android version, and the security patch level is there or under Settings > Security. How long those patches keep coming depends on the maker, as we explained for the Galaxy S23 earlier this month. On Android 14 or newer, install every update and look out for the November 2026 patch.

If a phone gets stuck restarting every minute and a half, don’t choose “wipe data” at the recovery prompt. Take it to someone who can clear the stuck messages over ADB.

This is a serious bug, and its handling made it worse. Mark B reported it to Google on 5th May, GrapheneOS says Google mishandled that report, and the fix was written in June. Four months later there’s a public tool that can drop someone’s emergency call, and still no bulletin naming the patch. On Android 12 and 13, anyone with your number and the researcher’s app can knock your phone off the network. If yours can’t be upgraded, plan your next phone around how many years of updates it gets.