Security flaw allows Android devices to be crashed via SMS
A newly discovered vulnerability in Android versions 12 through 17 allows remote attackers to induce repeated system crashes using WAP push messages.
As reported by Heise, security researcher Mark Blaszczyk has disclosed a critical vulnerability, dubbed the "SMS of Death," that affects Android versions 12 through 17. The flaw leverages an outdated WAP push system to send malformed data that crashes the system's telephony service.
The attack is classified as a zero-click, remote denial-of-service vulnerability. Once a device receives the malicious packet, it enters a boot loop, restarting every 90 seconds as it repeatedly attempts to process the corrupt data. This cycle can render the phone unusable and interrupt ongoing activities, including emergency calls. Because the malicious messages are processed by the system before reaching the inbox, the attack remains invisible to the user.
Blaszczyk has successfully reproduced the exploit on devices including the Pixel 9 and various Samsung Galaxy models. Google has assigned the flaw the identifier CVE-2026-58882 and developed a patch as of June 15. However, no official fixes are expected for older versions of Android, specifically versions 12 and 13.