● Covered by 2 sources · 2 reportsHigh impact1 negative1 neutral
Zero-Click Android Vulnerability Allows Remote Denial-of-Service via Malformed WAP Push SMS
Key points
- Malformed WAP Push SMS crashes `com.android.phone`.
- Vulnerability is zero-click and remote.
- Repeated attacks corrupt SMS database, causing persistent DoS.
- Recovery requires a factory reset.
- Exploit is tracked as CVE-2026-58882.
- Vulnerability affects Android 12 and 13 devices.
- Google patched the flaw in October 2026 for Android 14-17.
- Mark Blah discovered the vulnerability.
- Flaw is due to improper validation in WapPushOverSms.decodeWapPdu function.
- A malformed eight-byte WAP Push message triggers the exploit.
Vulnerability Details
A critical vulnerability has been discovered in Android's telephony component, specifically within the `WapPushOverSms.decodeWapPdu()` function. This flaw allows an attacker to trigger a `NegativeArraySizeException` by sending a specially crafted WAP Push SMS message. The issue arises because a `uintvar` value, read as a `long`, is cast to an `int` without a range check, leading to a negative value being used as an array size.
Impact on Telephony Services
Upon receiving the malformed message, the `com.android.phone` process crashes, resulting in dropped calls, including emergency calls. This attack requires no interaction from the victim and the message is not visible in the user's inbox. The vulnerability has been reproduced on multiple Android devices, including Pixel 9 and various Samsung Galaxy models, with a 100% success rate.
Persistent Denial-of-Service
While a single message causes a transient outage, sending approximately 30 such messages in rapid succession can lead to a race condition that corrupts the device's SQLite SMS database. Once corrupted, the `com.android.phone` process crashes immediately upon boot, rendering the phone permanently unable to use telephony services. A restart does not resolve this issue.
Recovery Challenges
Recovery from this persistent denial-of-service state is severe, requiring a factory reset of the device. This vulnerability poses a significant threat due to its zero-click nature, remote exploitability, and the potential for complete disruption of essential phone functions.
Updates
- Exploit is tracked as CVE-2026-58882.
- Vulnerability affects Android 12 and 13 devices.
- Google patched the flaw in October 2026 for Android 14-17.
- Mark Blah discovered the vulnerability.
- Flaw is due to improper validation in WapPushOverSms.decodeWapPdu function.
- A malformed eight-byte WAP Push message triggers the exploit.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
A security researcher released a proof-of-concept exploit for CVE-2026-58882, an Android vulnerability that allows remote disruption of cellular service or phone crashes via a specially crafted text message. The zero-click denial-of-service flaw affects Android 12 and 13 devices, as Google's patch in October 2026 updates only covers Android 14 through 17.
A zero-click vulnerability in Android's telephony service allows a remote attacker to crash `com.android.phone` by sending a malformed WAP Push SMS, disrupting active calls, including emergency services. Repeated attacks can corrupt the SMS database, leading to a persistent denial-of-service that renders the phone unable to use telephony functions until a factory reset.