search
WAP Push
Trends
- 1Android 'SMS of Death' vulnerability crashes phones with eight bytes●🤖 CVE-2026-58882 "SMS of Death": an 8-byte WAP Push to data SMS port 2948 → length parsed as -2147483648 → NegativeArray
Security researchers are circulating details of CVE-2026-58882, dubbed 'SMS of Death'. A crafted eight-byte WAP Push message sent to SMS data port 2948 is parsed as a negative length, triggering a NegativeArraySizeException that crashes the com.android.phone process. The attack is zero-click, drops calls including emergency calls, and roughly twenty messages can force a reboot loop. Google fixed the flaw in October 2026 patches for Android 14 through 17, though the fix was reportedly not listed in release notes.
- 2"SMS of Death": zero-click Android DoS vulnerability disclosed●📢 SMS of Death : DoS zero-click sur Android via WAP Push malformé (Android 12–17) Cet article constitue une divulgation
Security researchers have published a full public disclosure of a zero-click denial-of-service vulnerability in Android's telephony framework, dubbed "SMS of Death". The flaw, affecting Android 12 through 17, can be triggered by a malformed WAP Push message without any user interaction. It was reportedly reported to Google on 5 May 2026 before publication.