A critical zero-click vulnerability has been publicly disclosed affecting Android's telephony stack. Tracked as CVE-2026-58882 and dubbed the SMS of Death by security researcher Mark B, the flaw allows an attacker to remotely knock an Android phone off the cellular network and trap it in a crash loop using nothing more than the victim's phone number. No user interaction is required, the malicious message never appears in your inbox, and active voice calls including emergency calls to 911 can be dropped mid-conversation.
How It Works
The exploit targets Android's handling of WAP Push messages, an old SMS protocol that mobile carriers still use to deliver MMS configuration parameters silently in the background. Because these packets are processed automatically without any user action, an attacker only needs your phone number to trigger the attack.
When the malformed packet arrives, it carries an artificially inflated length parameter in its header. This triggers an integer overflow in Android's memory allocation system, flipping the value to negative 2,147,483,648. The telephony process, com.android.phone, which handles cellular connectivity, SIM communication, and voice calls, immediately crashes because it cannot allocate negative memory.
The process restarts within seconds, but the corrupted message remains unacknowledged in the carrier's queue. The carrier resends it. The process crashes again. The device is now stuck in an endless crash loop that can drop cellular service for days. If an attacker sends repeated bursts, Android's internal crash recovery engine called RescueParty kicks in, forcing the phone into recovery mode every 90 seconds and prompting the user to wipe all personal data.
Who Is and Is Not Getting a Fix
Google has developed a fix that catches the memory allocation exception and clears the corrupted message from the incoming queue automatically. The patch is included in the November 2026 Android Security Bulletin for Android 14, 15, 16, and 17.
Android 12 and 13 are not getting the patch. That is the part worth paying attention to. These versions share the exact same vulnerable telephony code and are estimated to still represent roughly 15 to 20 percent of active global Android traffic. Millions of older handsets will remain permanently exposed with no official fix coming.
What to Do Right Now
If you are on Android 14 or newer, go to Settings, System, and Software Update and install any pending security updates immediately. You want the November 2026 patch level applied as soon as it arrives on your device.
If you are on Android 12 or 13, there is no patch coming. The most practical protective step is to consider upgrading to a device that is still receiving security updates. Continuing to use an Android 12 or 13 device on a cellular network means this vulnerability remains permanently open on your handset.
If your device is already caught in a RescueParty boot loop, do not select the wipe data option at the recovery screen. The corrupted packet queue can be cleared without losing your data by connecting the phone to a computer and running targeted message purge commands through Android Debug Bridge during the boot window. That is a technical process, so if you are not comfortable with ADB, take the device to a repair shop or carrier store before attempting a factory reset.