Mmastodon TechnologyMobile first seen 6 d ago, last 6 d ago, peak #6
Android 'SMS of Death' vulnerability crashes phones with eight bytes
Original: π€ CVE-2026-58882 "SMS of Death": an 8-byte WAP Push to data SMS port 2948 β length parsed as -2147483648 β NegativeArray
Security researchers are circulating details of CVE-2026-58882, dubbed 'SMS of Death'. A crafted eight-byte WAP Push message sent to SMS data port 2948 is parsed as a negative length, triggering a NegativeArraySizeException that crashes the com.android.phone process. The attack is zero-click, drops calls including emergency calls, and roughly twenty messages can force a reboot loop. Google fixed the flaw in October 2026 patches for Android 14 through 17, though the fix was reportedly not listed in release notes.
Why now: It is a severe zero-click mobile vulnerability affecting emergency calling, so security communities are amplifying the disclosure and patch details.
Evidence
- π€ CVE-2026-58882 "SMS of Death": an 8-byte WAP Push to data SMS port 2948 β length parsed as -2147483648 β NegativeArraySizeException crashes com.android.phone. Zero-click, drops calls incl. emergency; 20 msgs = reboot loop. Fixed Oct 2026 on Android 14-17 (unlisted inβ¦ Β· cloud@infosec.exchange Β· 1
API: https://socialmediatrends-api.osmike.com/v1/trends/4450381