Updated

Updated · BleepingComputer · Oct 31

Researcher Releases 8-Byte Android SMS Exploit, Leaving Android 12 and 13 Phones Exposed

Updated

Updated · BleepingComputer · Oct 31

Researcher Releases 8-Byte Android SMS Exploit, Leaving Android 12 and 13 Phones Exposed

Q: Why might some Android 12 and 13 phones still be exposed to the “SMS of Death” even after Google’s October 2026 patch?

Some Android 12 and 13 phones may still be exposed because Google’s October 2026 fix was released for Android 14 through 17, not broadly for those older versions. Unless a phone maker or carrier separately backported and shipped the telephony patch, devices on 12 and 13 keep the same vulnerable code. That risk is amplified by Android’s fragmented update system. Even on supported devices, protection depends on the manufacturer and carrier actually delivering the update, and users may need to restart to complete installation. A patch date alone may not guarantee the specific telephony fix is present in a given vendor build. The flaw sits in Android’s core telephony framework, so it is not something users can mitigate with an app setting. Older phones that are outside Google’s normal security support window are especially likely to miss the fix entirely. Reports around the disclosure said Android 12 and 13 were no longer in Google’s standard support stream, making a patch less likely unless vendors take extra action. There is also a practical recovery issue: on unpatched phones, the malformed WAP Push SMS can persist in the raw SMS queue and be retried on reboot or redelivery, causing repeated crashes or reboot loops. So a device can remain effectively affected until the malicious message is removed or the phone is patched.

3 articles · Updated · BleepingComputer · Oct 31

A public proof-of-concept for CVE-2026-58882 now lets attackers crash Android phones or cut cellular service with a zero-click data SMS sent to port 2948.
The 8-byte WAP Push message exploits improper header-length validation in decodeWapPdu, triggering a NegativeArraySizeException that crashes the com.android.phone process before any SMS appears in the inbox.
That crash can drop active calls — including emergency calls — and repeated delivery attempts can trap devices in recurring failures; in testing, 20 malicious messages pushed one Android 12 phone into recovery-mode reboots every 90 seconds.
Google reportedly fixed the flaw in October 2026 updates for Android 14 through 17, but the bug is absent from the public bulletin and older Android 12 and 13 devices remain vulnerable.
The patch catches the exception and deletes malicious messages from the SMS database, while users still need manufacturer- and carrier-delivered updates — and sometimes a restart — to be protected.