EN PT-BR
← Voltar ao feed
high

"SMS of Death" zero-click Android flaw (CVE-2026-58882): malformed WAP Push SMS crashes telephony, public PoC, Critical in November 2026 bulletin

3 fonte(s) · 3 atualização(ões) · publicado 30/10/2026 02:08 · coletado há 9 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 01/11/2026 11:01; os links antigos trazem para cá.

Fontes: securityaffairs.com ↗ bleepingcomputer.com ↗ gbhackers.com ↗

A zero-click denial-of-service flaw in Android dubbed SMS of Death (tracked as CVE-2026-58882 per bleepingcomputer.com) lets a single malformed WAP Push SMS repeatedly crash the com.android.phone telephony process. The message arrives silently on SMS port 2948, never appears in the inbox or reveals the sender, and can drop active calls, including emergency calls (gbhackers.com). The researcher, credited as Mark B (gbhackers.com), Mark Blah (bleepingcomputer.com) or Mark Blaszczyk (securityaffairs.com), reported it to Google's Android and Devices Vulnerability Reward Program on 5 May 2026 and disclosed it publicly on 29 October 2026; a working proof of concept is now public (bleepingcomputer.com). Google fixed it in the October 2026 Android security update for Android 14 through 17. securityaffairs.com (1 November) reports the CVE is rated Critical in the November 2026 Android Security Bulletin, while bleepingcomputer.com (31 October) had reported it absent from the October bulletin. Android 12 and 13 remain unpatched unless vendors issue updates. The researcher reproduced it on a Pixel 9 (April 2026 firmware) and several Samsung Galaxy and Galaxy A devices, observing intermittent outages of up to a week from one message (gbhackers.com, securityaffairs.com). The vulnerable code appears present from Android 12 to 17 (securityaffairs.com). No code execution or data theft was demonstrated. A quoted post cited by securityaffairs.com says a custom Android build has included the patch in its security preview releases since build 2026072901.

Entenda a falha

A vulnerabilidade

CVE-2026-58882, dubbed "SMS of Death", is a zero-click denial-of-service flaw in Android's telephony framework, in WapPushOverSms.decodeWapPdu(), which runs in com.android.phone. The attacker only needs to send one malformed WAP Push data SMS to port 2948 of the victim's number, with no authentication or user interaction. The result is repeated telephony crashes, dropped calls (including emergency calls) and, with enough messages, reboot loops. No code execution or data theft was shown. The vulnerable code appears present from Android 12 to 17. Google fixed Android 14 to 17 in the October 2026 update; Android 12 and 13 stay exposed unless vendors ship updates. securityaffairs.com (1 Nov) says it is rated Critical in the November 2026 bulletin, while bleepingcomputer.com (31 Oct) had found it absent from the October one.

Como funciona

A WAP Push message arrives as a data SMS on port 2948 and Android hands it to WapPushOverSms for decoding before it reaches the inbox, so the user sees nothing and the sender is not shown. While decoding, the code reads the Wireless Session Protocol header length as a variable-length unsigned integer (uintvar), returned as a long, and casts it to a signed 32-bit int. For a crafted five-byte value the result is -2147483648. The code then uses that number as the size of a byte array, which raises an uncaught NegativeArraySizeException on the main telephony thread and kills com.android.phone. Each crash costs one to two seconds of service. Carrier redelivery of unacknowledged messages, or messages left in the pending inbound SMS queue, can re-trigger the crash, even after a reboot.

Por que é vulnerável

The root cause is a missing range check: a long header length is cast to a signed 32-bit int and the resulting negative number is used as an allocation size. The resulting exception is not caught on the processing path, so one malformed network message can kill a core system process. Google's fix, "Fix remote DoS in decodeWapPdu", broadens exception handling to catch runtime failures and deletes the triggering messages from the SMS database so they are not reprocessed. It does not add the header-length bounds check the researcher proposed. The articles do not say why the bug went unnoticed.

Onde está

The flaw is in WapPushOverSms.decodeWapPdu(), a component under frameworks/opt/telephony (per securityaffairs.com), running in com.android.phone; the fix is titled "Fix remote DoS in decodeWapPdu", but the articles give no commit link.

Como foi descoberta

The researcher, credited as Mark B (gbhackers.com), Mark Blah (bleepingcomputer.com) or Mark Blaszczyk (securityaffairs.com, which calls him independent), reported it to Google's Android and Devices Vulnerability Reward Program on 5 May 2026 and published the technical disclosure on 29 October 2026. The articles do not say how he found it. He reproduced it on a Pixel 9 (April 2026 firmware) and several Samsung Galaxy and Galaxy A devices. The fix status for Android 14 to 17 comes from his documentation. A quoted post in securityaffairs.com, from a custom Android build, says the CVE is Critical in the November 2026 bulletin and that its builds have had the patch since release 2026072901. Only bleepingcomputer.com and securityaffairs.com give the CVE. A GitHub contributor, Sakis, found a way to purge the messages with ADB.

PoC pública

The researcher published a working proof of concept that sends the malicious WAP Push messages from another Android device and triggers the com.android.phone crash (bleepingcomputer.com). In his tests one message caused intermittent outages of up to a week, and about 20 caused reboot loops; one Android 12 device rebooted into recovery roughly every 90 seconds. Sources differ on recovery: bleepingcomputer.com says a factory reset was needed, gbhackers.com says an Android 12 case was cleaned via ADB without one; they may be different cases. With the PoC public and simple, unpatched Android 12 and 13 devices are most urgent; others should install the October 2026 update or later. The link is the BleepingComputer article reporting the release, not the PoC's own address.

Publicada em: www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/ ↗

Explicação gerada por IA a partir da matéria e dos artigos, em 01/11/2026 11:16.

Detalhes técnicos

  • The bug is in WapPushOverSms.decodeWapPdu(). The Wireless Session Protocol header length is read as a variable-length unsigned integer returned as a long, then cast to a signed 32-bit int without range validation (gbhackers.com). The resulting value is -2147483648 (bleepingcomputer.com). A five-byte uintvar 88 80 80 80 00 decodes to 0x80000000 (securityaffairs.com).
  • The negative value is used to allocate a byte array, raising an uncaught NegativeArraySizeException on the main telephony thread and killing com.android.phone. Each crash costs one to two seconds of telephony service (gbhackers.com, securityaffairs.com).
  • The trigger is an eight-byte WAP Push (01 06 88 80 80 80 00 BE) sent as a data SMS to port 2948. Android processes it before it reaches the inbox, so the victim sees no sign of it (bleepingcomputer.com). The PoC can send the messages from another Android device (bleepingcomputer.com).
  • Carrier redelivery of unacknowledged messages amplifies the outage. Messages stuck in the pending inbound SMS queue can re-trigger crashes after reboot (gbhackers.com, bleepingcomputer.com, securityaffairs.com).
  • About 20 messages caused extended unusability and reboot loops, and the phone process can keep crashing at startup. One Android 12 device rebooted into recovery mode roughly every 90 seconds (both sources).
  • A GitHub contributor, Sakis, found a way to purge the malicious messages with ADB, which requires a computer and advanced knowledge (bleepingcomputer.com, securityaffairs.com).

Remediação

  • Install the manufacturer's October 2026 Android security update or later, including the November 2026 bulletin where available. Availability depends on the manufacturer and carrier, and a restart may be needed to complete installation (bleepingcomputer.com, securityaffairs.com).
  • Google's fix, "Fix remote DoS in decodeWapPdu", broadens exception handling for runtime failures and deletes the triggering messages from the SMS database to prevent reprocessing. It does not apply the researcher's proposed header-length bounds check (gbhackers.com, bleepingcomputer.com).
  • Owners of Android 12 and 13 devices should check with their vendor and replace or isolate unsupported devices (bleepingcomputer.com, securityaffairs.com).
  • Restrict use of the published PoC to explicitly authorized testing, since disruption can affect emergency communications (gbhackers.com).

Relatos divergentes

  • Researcher name: Mark B (gbhackers.com), Mark Blah (bleepingcomputer.com) and Mark Blaszczyk (securityaffairs.com, which also uses "Mark Blah" in its body); probably the same person. The fullest form is Mark Blaszczyk, but it is not confirmed.
  • CVE: only bleepingcomputer.com and securityaffairs.com give CVE-2026-58882; gbhackers.com assigns none.
  • Bulletin listing: bleepingcomputer.com (31 October) says the flaw is not listed in the October bulletin. securityaffairs.com (1 November, the later source) says it is rated Critical in the November 2026 bulletin. These may be consistent if the entry was added in November; treat the later report as more current.
  • Patch scope: gbhackers.com says the fix covers Android 14-17. bleepingcomputer.com adds that Android 12/13 devices are unpatched. securityaffairs.com agrees that Android 12 and 13 may stay exposed without updates.
  • Android 12 recovery: gbhackers.com says one Android 12 case was cleaned up via ADB without a factory reset. bleepingcomputer.com says an Android 12 device in a recovery-mode reboot loop required a factory reset. These may be different cases.

Linha do tempo

  1. securityaffairs.com ↗ · pub. 01/11/2026 09:16 · coletado 01/11 11:00

    SMS of Death: zero-click WAP Push SMS crashes Android telephony (CVE-2026-58882), rated Critical in the November 2026 bulletin

    Securityaffairs.com reports that CVE-2026-58882 is rated Critical in the November 2026 Android Security Bulletin, which was not previously known. A quoted post, apparently from a custom ROM project, says the patch has been in its security preview releases since build 2026072901. The article also gives the researcher's full name as Mark Blaszczyk and states that the vulnerable code spans Android 12 to 17.

    ler a análise desta fonte

    Securityaffairs.com reports that CVE-2026-58882 is rated Critical in the November 2026 Android Security Bulletin, which was not previously known. A quoted post, apparently from a custom ROM project, says the patch has been in its security preview releases since build 2026072901. The article also gives the researcher's full name as Mark Blaszczyk and states that the vulnerable code spans Android 12 to 17.

    A zero-click denial-of-service flaw in Android dubbed SMS of Death lets a single crafted WAP Push message crash the com.android.phone telephony process, interrupting calls including emergency calls. The issue was documented by independent researcher Mark Blaszczyk (also rendered as "Mark Blah" in the article). It is tracked as CVE-2026-58882 and rated Critical in the November 2026 Android Security Bulletin. The message is delivered as a binary data SMS on port 2948, does not appear in the inbox, and needs no user interaction. Repeated processing can cause a persistent outage lasting up to a week or a boot-loop-like state. The researcher reproduced it on the Google Pixel 9 and Samsung Galaxy and Galaxy A devices, with vulnerable code in Android 12 to 17.

    Technical Details

    • The bug is in the WapPushOverSms framework component (frameworks/opt/telephony). decodeWapPdu() reads the WSP header length as a uintvar returned as a 64-bit value, then casts it to a 32-bit integer without a range check.
    • A five-byte uintvar of 88 80 80 80 00 decodes to 0x80000000, which becomes -2147483648 as a signed int. Allocating new byte[-2147483648] throws an uncaught NegativeArraySizeException on the telephony main thread and kills com.android.phone.
    • Each processing causes roughly 1-2 seconds of telephony disruption. The message can stay in the incoming SMS queue and be reprocessed, and carrier retransmission adds further crashes.
    • The researcher saw intermittent crashes for up to a week after one message. About twenty messages can make a device unusable for a long period, and the phone process can crash at startup. Recovery may require ADB to clear the SMS queue.

    Remediation

    • Check the Android security patch level and apply available updates, in particular the November 2026 bulletin.
    • According to the researcher's documentation, Google shipped a fix in the October 2026 update for Android 14, 15, 16 and 17. Android 12 and 13 devices may stay exposed without vendor updates.
    • Pay particular attention to devices that no longer receive manufacturer support.
  2. bleepingcomputer.com ↗ · pub. 31/10/2026 12:35 · coletado 31/10 14:00

    Android 'SMS of Death' zero-click flaw CVE-2026-58882 gets public PoC, can crash phones and cut emergency calls

    ler a análise desta fonte

    A researcher, Mark Blah, has published a proof-of-concept exploit for CVE-2026-58882, dubbed "SMS of Death", a zero-click denial-of-service flaw in Android. A specially crafted WAP Push text message can crash the phone's cellular stack, drop ongoing calls (including emergency calls) and disrupt connectivity. Google reportedly fixed the issue in the October 2026 Android updates for Android 14 through 17, but the flaw is not listed in the October security bulletin, and Android 12 and 13 devices remain unpatched. With a working PoC now public, unpatched devices are exposed to remote disruption without any user interaction.

    Technical Details

    • The bug is an improper validation of a header-length value in WapPushOverSms.decodeWapPdu. The value is converted to a signed 32-bit integer without a bounds check and becomes -2147483648.
    • Allocating memory with this negative value triggers a NegativeArraySizeException that crashes the com.android.phone process, which manages cellular functions.
    • The malicious message is an eight-byte WAP Push (01 06 88 80 80 80 00 BE) sent as a data SMS to port 2948. Android processes it before it reaches the SMS inbox, so the victim sees no indication of the cause.
    • Crashes can repeat when carriers redeliver the message or when Android processes messages already stored on the device. In testing, 20 messages put phones into reboot loops. One Android 12 device rebooted into recovery mode about every 90 seconds and required a factory reset.
    • A GitHub contributor named Sakis found a way to remove the malicious messages with Android Debug Bridge (ADB), but it requires a computer and advanced knowledge.
    • The PoC can send the malicious messages from another Android device.

    Remediation

    • Install the latest Android security updates. Google's fix, "Fix remote DoS in decodeWapPdu", catches the exceptions raised by malformed messages and deletes the malicious messages from the SMS database.
    • Availability depends on the device manufacturer and carrier, and a restart may be needed to complete installation.
    • Android 12 and 13 devices did not receive the fix, so users should check with their vendor, or replace or isolate unsupported devices.
  3. gbhackers.com ↗ · pub. 30/10/2026 02:08 · coletado 30/10 03:00 primeiro registro

    "SMS of Death": zero-click Android flaw crashes telephony process via malformed WAP Push SMS

    ler a análise desta fonte

    A researcher known as Mark B disclosed a zero-click Android denial-of-service flaw dubbed SMS of Death that repeatedly crashes the com.android.phone telephony process using a single malformed WAP Push SMS. The message arrives silently on SMS port 2948, never appearing in the inbox or revealing the sender, and can drop active calls including emergency calls. Reported to Google's Android and Devices Vulnerability Reward Program on 5 May 2026 and publicly disclosed on 29 October 2026, the issue was fixed in the October 2026 Android security update for Android 14 through 17. The researcher reproduced it on a Pixel 9 (April 2026 firmware) and several Samsung Galaxy devices, observing intermittent outages lasting up to a week from a single message and extended unusability after roughly 20 messages. No code execution or data theft was demonstrated.

    Technical Details

    The bug lives in WapPushOverSms.decodeWapPdu() in Android's telephony framework. The Wireless Session Protocol header length is read as a variable-length unsigned integer returned as a long, then cast directly to a signed 32-bit int without range validation. An oversized value becomes negative and is used to allocate a byte array, raising an uncaught NegativeArraySizeException on the main telephony thread and killing com.android.phone. Each crash costs one to two seconds of telephony service, and carrier redelivery of unacknowledged messages amplifies the outage. Messages stuck in Android's pending inbound SMS queue can re-trigger crashes after reboot; one Android 12 case involved repeated recovery-mode reboots, remediated via targeted queue cleanup over ADB without a factory reset.

    Remediation

    Install the manufacturer's October 2026 Android security update or later. Google's fix broadens exception handling for runtime failures and cleans up the triggering messages to prevent reprocessing, rather than applying the researcher's proposed header-length bounds check. Use of the published proof of concept should be restricted to explicitly authorized testing, since disruption can affect emergency communications.