An invisible text message could be enough to crash an Android phone's calling service, interrupt emergency calls, and potentially leave the device trapped in repeated crashes.
Security researcher Mark Blaszczyk has disclosed a critical vulnerability, tracked as CVE-2026-58882, that allows attackers to disrupt Android's telephony framework by sending a specially crafted WAP Push SMS.
Tracked as CVE-2026-58882, the flaw affects Android's core telephony framework. The attack requires no action from the recipient. Victims do not need to open a message, click a link or even receive a notification.
According to Blaszczyk, the malicious message never appears in the inbox, and Android does not reveal the sender's number. The vulnerability affects Android 12 through 16, with Google distributing a fix for Android 14 through 17 in its October 2026 security update. Devices running older versions without access to security patches could remain exposed.
How a few bytes can crash Android
The problem sits inside Android's WapPushOverSms component, which processes WAP Push messages sent through mobile networks.
Blaszczyk found that Android reads the message's header length as a large number before converting it into a smaller integer without checking whether the value is valid. A specially crafted five-byte sequence makes that conversion produce a negative number. When Android attempts to allocate memory using that value, it triggers a NegativeArraySizeException.
The exception crashes com.android.phone, the system process responsible for telephony functions. Testing across Google Pixel and Samsung Galaxy devices produced a 100% reproduction rate, according to the researcher.
Repeated crashes can leave phones unusable
The immediate consequence is dropped calls, including emergency calls. The phone's telephony service typically restarts after about one to two seconds, temporarily interrupting network access. However, the problem can continue because carriers may resend messages that the device never successfully acknowledges.
The malicious SMS also remains in Android's pending message queue. When the phone restarts, the system attempts to process it again, potentially triggering another crash. Blaszczyk found that approximately 20 messages could make a device unusable for an extended period. Android's RescueParty recovery mechanism can eventually push repeatedly crashing devices into recovery mode.
Blaszczyk described a recovery procedure involving Android Debug Bridge (ADB) to remove the offending messages without wiping the device. However, the procedure requires technical access that many smartphone owners may not have configured in advance.
Google's fix addresses the repeated crash
Google received Blaszczyk's report on May 5, 2026. An engineering change addressing the vulnerability was committed on June 15. Rather than implementing the researcher's proposed header-length validation, Google expanded exception handling to catch runtime errors and remove malformed messages from the pending queue.
The October 2026 security update includes the fix for Android 14 through 17. GrapheneOS has also indicated that the vulnerability will appear in the November security bulletin, following earlier distribution through security previews.
The different timelines illustrate a recurring challenge with Android security: a fix reaching the Android Open Source Project does not automatically mean every supported phone receives it immediately.
What Android users should do
For consumers, this vulnerability creates a problem that ordinary security habits cannot prevent. There is no suspicious link to avoid or message to delete because the attack happens before users see anything.
Installing the latest available Android security update is the most practical defense. Owners of older devices that no longer receive security patches face greater uncertainty because the underlying vulnerability may remain unaddressed.
The emergency-calling implications are particularly concerning. A phone that unexpectedly loses telephony functionality could leave someone unable to contact emergency services when they need help most.
The bigger problem for Android's device ecosystem
The vulnerability also exposes a weakness in how mobile security updates reach consumers. Google can correct a flaw in the underlying platform, but manufacturers and carriers still influence when patches reach individual devices.
Manufacturers and carriers influence update availability, leaving users dependent on device-specific support schedules. Phones that no longer receive security patches may remain exposed even after the underlying vulnerability has been corrected.
Blaszczyk's publication of proof-of-concept code adds urgency to patch deployment. Because the reported attack requires no interaction from the recipient, ordinary precautions against suspicious messages offer little protection.
The broader concern extends beyond individual devices. Vulnerabilities that disrupt telephony services can affect the reliability of mobile communications, making timely updates important for both user security and service availability.
In other news: Anthropic says an unreleased Claude model developed five working exploit chains targeting Chrome, Safari, Android, Windows, and Linux.