ISLAMABAD: Android smartphone users have been warned about a serious security vulnerability dubbed the “SMS of Death,” which can allow attackers to crash affected devices by sending specially crafted text messages without requiring any action from the recipient.
The flaw, identified as CVE-2026-58882, can disrupt phone calls, interfere with emergency communications and potentially force vulnerable smartphones into repeated crashes or restart loops.
Security researcher Mark Blaszczyk, who disclosed the vulnerability, said the attack could be triggered through a malicious SMS that remains invisible to the recipient.
Unlike conventional text-message scams, the attack does not require users to open a message, click a suspicious link or download an application.
Instead, the specially constructed message exploits a weakness in Android’s handling of incoming messages, affecting the system responsible for managing telephone calls.
How the Android ‘SMS of Death’ attack works
According to the researcher, a single malicious message can trigger a system crash affecting the phone’s calling functionality.
The message does not appear in the user’s SMS inbox, and the device does not display a notification indicating that it has been received.
This makes the attack particularly concerning because users may experience unexpected phone failures without knowing that a malicious message was responsible.
The vulnerability can interrupt ongoing calls, including calls to emergency services, potentially preventing users from accessing assistance when needed.
Blaszczyk reported that sending approximately 20 specially crafted messages could cause an affected smartphone to crash repeatedly or become trapped in a boot loop.
A boot loop occurs when a device repeatedly attempts to restart but fails to complete the startup process, making it difficult or impossible to use normally.
The reported behaviour raises concerns about the potential for attackers to deliberately disrupt mobile communications.
Google Pixel and Samsung Galaxy devices affected
The vulnerability has reportedly been observed on affected Android smartphones, including Google Pixel and Samsung Galaxy devices.
Researchers linked the weakness to Android code that has existed since Android 12, suggesting that multiple generations of the operating system could be affected.
However, the presence of the vulnerable code does not necessarily mean that every Android smartphone is susceptible, as exposure can depend on the device’s software version and security updates.
The vulnerability has been assigned the tracking identifier CVE-2026-58882.
Its ability to disrupt calls without user interaction has raised particular concerns about the reliability of affected devices during emergencies.
Researcher says Google was alerted in May
Blaszczyk said he first reported the vulnerability to Google on May 5, 2026.
According to the researcher, the company initially did not recognise the reported behaviour as a security issue.
He subsequently made technical details and a demonstration of the vulnerability public on October 29.
However, Android code records indicate that Google had developed a fix by June 15, with the correction becoming available through security previews in July.
The researcher also said the vulnerability had been addressed in October security updates covering Android versions 14 through 17.
The reported timeline suggests that fixes were developed before the vulnerability’s public disclosure, although users with outdated software may remain exposed.
Can the bug affect emergency calls?
One of the most serious reported consequences of the vulnerability is its potential to interrupt emergency communications.
Because the malicious SMS affects Android’s calling system, an attack could disconnect an active telephone conversation, including a call to emergency services.
Unlike attacks designed to steal passwords or financial information, the reported vulnerability primarily threatens device availability and communication reliability.
Repeated malicious messages could leave affected users temporarily unable to make or receive calls.
The risk is especially significant when reliable phone access is needed during medical emergencies, accidents or other urgent situations.
How Android users can protect their phones
Security experts have advised Android users to install the latest available security updates to reduce their exposure to the vulnerability.
Users of Google Pixel, Samsung Galaxy and other Android smartphones should check whether their devices have received recent security patches.
To check for updates, users can open their phone’s settings and navigate to the software update or system update section. The exact steps may vary depending on the manufacturer.
Installing available security patches is particularly important because the reported attack does not require any interaction with a malicious message.
Users cannot reliably protect themselves simply by avoiding suspicious links or refusing to open messages, as the vulnerability can reportedly be triggered before a message becomes visible.
Smartphones running outdated Android software or missing relevant security updates may remain vulnerable.
The disclosure highlights the importance of keeping mobile operating systems updated, particularly when security flaws can affect essential functions such as voice calls and emergency communications.