Invisible “SMS of Death” crashes Android phone, traps victim in reboot loop until factory reset

An invisible SMS crashes Android phones, cuts off calls, including to emergency services, and can trap users in a reboot loop, a researcher warns. The “SMS of Death” exploit code is now public, and the fix is underway.

Simply invisible SMS messages can make Android phones unusable, requiring a factory reset or an involved recovery procedure, a new security advisory warns.

“A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim,” Mark Blaszczyk, a security researcher (@sourone), said in a report.

WAP Push is a legacy system that lets mobile carriers send hidden instructions to phones without the user taking any action, such as prompting devices to download MMS or apply carrier settings.

And attackers can already leverage SMSes to target victims using a proof-of-concept “SMS of Death” app, made available on GitHub – it remotely and silently sends a crafted 8-byte WAP Push PDU over SMS to a target handset.

The bug requires no user interaction, the exploit works remotely, and often bricks the device – recovery requires connecting to the phone using Android Debug Bridge (ADB), according to the researcher. The attack is completely invisible, and the SMS messages don’t appear in the inbox.

The author disclosed the bug responsibly in May, 2026. Google committed a fix on June 15 and pushed the patch to the Android Open Source Project (AOSP), but the fix has yet to reach all supported devices.

The critical vulnerability affects Android 12 through 16, meaning that many phones will never receive a fix.

GrapheneOS said the bug will be included in the upcoming November security bulletin. The critical flaw is patched in Android 14–17 with the October 2026 update. It has been assigned CVE-2026-58882.

How does the bug work?

The entire payload is just eight bytes sent via SMS, and five of those bytes represent a single number – the header’s length.

When the phone receives the SMS and starts processing it automatically, it sees a valid value: 2,147,483,648, in a format known as long (0x80000000), which is used for large numbers.

However, Android then converts it to a smaller data type, a 32-bit integer (int), without checking the range, causing overflow. The number flips to a negative value (-2,147,483,648) after conversion, which makes no sense as a header length.

The negative value triggers a fatal error, killing com.android.phone, a component that handles calls.

The victim does nothing. No tap, no open, no notification,

said the researcher.

This drops any active call, including emergency calls, without any user interaction – the victim never sees the message or the sender’s number.

The phone loses service for only about 1-2 seconds, until the com.android.phone component restarts. But then another surprise hits – carriers resend the SMS message because the phone never acknowledged receipt, making the situation worse.

The malformed message also remains queued, and the phone retries processing it on every boot, crashing on startup until it's cleared.

Worst-case scenario – reboot loop

The attacker can send around 20 messages, leading to persistent denial of service – this would make the device unusable for an “extended period,” the researcher warns.

The poison messages sit in the pending inbound queue, and the device tries to retrieve them on every boot until Android’s RescueParty, an automatic recovery feature, reboots the device into recovery after roughly 90 seconds.

“The malformed message stays queued and is retried on every boot, so the phone can crash on startup until it is cleared,” the researcher explains.

Mark B. tested the exploit on a Pixel 9 running April 2026 firmware and on various Samsung Galaxy A-series devices, achieving a 100% reproduction rate.

Android's own safety system (RescueParty) ultimately forces a bricked device into recovery mode, prompting a normal user to perform a factory reset.

To recover a bricked device without a factory reset, users need to connect to it from another computer via ADB and delete specific data within a short window after boot completes to break the cycle.

Working cyberweapon

The researcher calls the proof-of-concept code “a working weapon” – it remotely disrupts and bricks mobile phones, which fits the definition of a “Destructive Remote DoS.” Remote attackers can leave victims without service, and potentially force them to wipe all the data during a factory reset.

The released information is strictly for security research, education, and defensive testing, the author warns.

“Using it against anyone else is a crime, and interfering with a person's ability to reach emergency services (000) is a serious criminal offense in Australia and most countries.”