Android SMS of Death Bug: Is Your Phone at Risk and How to Stay Safe

The Android SMS of Death bug lets a single hidden text message crash the phone’s calling service, dropping active calls (including emergency calls) without you tapping anything. Phones on the October 2026 Android security patch or later are reportedly protected, but phones still on Android 12 or 13 are not getting a fix, and the researcher’s technical write-up is now public.

Here is what the flaw does, how to check in 30 seconds whether your phone is patched, and what to do if your phone is too old to get the update.

Quick summary

• What it is: a zero-click flaw in Android’s WAP Push SMS handling that crashes the phone (telephony) process.
• What happens: calls drop, you lose network for 1–2 seconds per message, and repeated messages can cause long outages or a reboot loop.
• Who is affected: the researcher reproduced it on Android 12 to Android 16.
• Fix: Google’s fix reached Android 14, 15, 16 and 17 with the October 2026 security release, according to the researcher.
• No fix: Android 12 and 13 phones that no longer get security updates.
• Your move: check your security update date today and install any pending update.

What is the Android SMS of Death bug?

It is a remote denial-of-service flaw in a part of Android’s telephony code called WapPushOverSms, which reads special “WAP Push” text messages that carriers have used for years to send settings. A message with a deliberately broken header length makes the code try to create an array with a negative size, and the error is not handled, so the phone process (com.android.phone) crashes.

Also read: Binance Hack 2026: What the $6.3 Billion Theft Means for Indian Users

The message is silent. You don’t see it in your inbox and you don’t need to open anything, which is why researchers call it “zero-click”. The bug was reported to Google’s Android vulnerability reward programme on 5 May 2026, a fix was written on 15 June 2026, and the researcher published the full write-up on 29 October 2026. Coverage of the flaw has linked it to CVE-2026-58882, reportedly rated Critical, but Google’s November 2026 bulletin was not yet online when we checked, so we could not confirm that listing ourselves.

What can a single SMS do to your phone?

One message knocks out calling for a moment; a stream of them can make the phone unusable for calls. According to the researcher’s documentation:

• Any active call drops, including an emergency call.
• The phone shows no service for about 1–2 seconds per message while the phone process restarts.
• Carriers may redeliver the failed message, so the crash can repeat by itself.
• Around 20 messages can make a device unusable for an extended period.
• Because the message can be retried at every start-up, some phones can get stuck in a reboot loop that ends at a recovery screen offering to wipe data.

The flaw does not let anyone read your messages, steal data or install apps. It is a disruption attack. We found no official report of it being used against real users so far, but now that the details are public, the risk for unpatched phones is higher than before.

Which Android phones are affected?

Your Android version and security patch date decide your risk, not your phone brand. The researcher reproduced the crash on Pixel and Samsung phones, and the same code ships in Android from every brand.

Android version	Fix available?	What to do
Android 17	Yes (October 2026 patch or later)	Install the latest system update
Android 16	Yes (October 2026 patch or later)	Install the latest system update
Android 15	Yes (October 2026 patch or later)	Install the latest system update
Android 14	Yes (October 2026 patch or later)	Install the latest system update
Android 13	No fix from Google	Ask your brand about updates; plan an upgrade
Android 12	No fix from Google	Plan an upgrade; keep a backup phone for emergencies

Having Android 14 or newer is not enough on its own. The fix only arrives when your phone maker ships a security update dated October 2026 or later. Many budget phones in India get updates every two or three months, so a phone on Android 15 with a July 2026 patch is still exposed.

How to check if your phone is protected

It takes under a minute. Google’s own help page gives this path, and most brands use the same or a similar one:

1. Open Settings.
2. Tap About phone, then Android version (on some phones, Software information).
3. Look at Android security update (or “Android security patch level”).
4. If the date is 1 October 2026 or later, you have the fix, according to the researcher.
5. If it is older, go to Settings > System > Software update (or Settings > Software update on Samsung) and install anything pending.

Restart the phone after installing and check the date again. If no update shows up, your brand may not have released it for your model yet; check again in a few days.

What to do if your phone is on Android 12 or 13

There is no setting that blocks these messages, so the practical answer is to reduce how much you depend on an unpatched phone.

• Check for a brand update anyway. Some makers back-port security fixes to older versions; your update screen is the only reliable answer.
• Keep a backup way to call 112. If an elderly parent or child relies on an old phone, a second patched phone or a basic feature phone is a sensible backup.
• Plan an upgrade. When you buy, check how many years of security updates the brand promises in writing.
• If the phone gets stuck rebooting, don’t wipe it straight away. The researcher warns the recovery screen’s “wipe data” option erases everything; contact your carrier or the brand’s service centre first, as recovery can be done with a computer (ADB) by a technician.

Businesses that hand out company phones should treat this like any other patch-management task: list every device, its Android version and patch date, and retire the ones that no longer get updates. If you need help with that, Suprams covers mobile and endpoint security under its cybersecurity services.

For other recent alerts, see our explainers on Apple’s threat notifications and the CERT-In Apple advisory. Samsung owners waiting for a bigger update can also check our One UI 9 update guide.

How Google fixed it, and why researchers want more

Google’s fix catches the error and deletes the bad message so it can’t be retried, the researcher says. That stops the crash on patched phones. The researcher had proposed a stricter check on the header length itself, and has publicly said Google chose the narrower approach. For users, the outcome is the same: once patched, the message no longer crashes the phone.

Frequently asked questions

Can the SMS of Death steal my data?

No. It is described as a denial-of-service bug: it crashes the phone service and drops calls, but it does not give access to your messages, photos or accounts.

Will I see the malicious SMS in my inbox?

No. WAP Push messages are handled in the background, so the message is invisible and you don’t need to open or tap anything for it to work.

Does turning off RCS or using another SMS app help?

We found no official guidance saying it does. The bug sits in Android’s telephony system, not in the messaging app, so the security update is the fix.

Are iPhones affected?

No. The flaw is in Android’s own telephony code, and the researcher’s report covers Android only.

Bottom line

The Android SMS of Death can’t steal anything, but it can cut a phone off mid-call, which matters most in an emergency. Check your security update date today: October 2026 or later means you’re covered. If your phone is stuck on Android 12 or 13, keep a backup way to call for help and start planning an upgrade.

Sources

• SMS of Death: zero-click Android telephony DoS (researcher’s original write-up)
• Android Security Bulletin, October 2026 (Google)
• Check and update your Android version (Google Help)

About The Author