Android SMS of Death Flaw: Update Your Phone Now

A researcher has published a working exploit for the Android SMS of Death flaw, BleepingComputer reported on Oct. 31, 2026. One specially built text message can crash a phone or knock out its cellular service. The report does not say attackers are using it in the wild yet.

Google already fixed the bug for newer phones. Older ones are the problem. If your phone runs Android 12 or 13, it may never get the fix.

That matters for a small office. Phones are how your team takes calls, gets login codes and reaches your clients. Here is who should worry, who can relax, and what to check today.

What the Android SMS of Death flaw does

The flaw is tracked as CVE-2026-58882. A CVE is just a catalog number for a known security bug.

It is a “zero-click” flaw. That means nobody has to tap or open anything. The phone handles the bad message on its own, before it ever lands in your inbox. So you would see no odd text and have no clue what went wrong.

According to the report, the crash hits the part of Android that runs cellular functions. That can drop calls in progress, including calls to emergency services.

The researcher, Mark Blah, says repeated attacks can make it worse. In his testing, 20 bad messages could trap phones in a reboot loop. On one Android 12 phone, the device restarted into recovery mode about every 90 seconds. The owner had to factory reset it to get out. A factory reset wipes the phone.

Who is at risk, and who can relax

Phones on Android 14 through 17 that have installed Google’s October 2026 security update should be fine. Google reportedly fixed the bug in that update.

Phones on Android 12 and 13 are the concern. BleepingComputer says they did not receive the fix and remain vulnerable.

There is one odd detail. The report says the flaw is not listed in Google’s October security bulletin, even though the fix reportedly shipped. So don’t count on the bulletin to tell you whether you are covered. Check the phone itself.

Keep this in perspective too. The exploit is public, but no attacks are reported yet. A crash is annoying and could be dangerous in an emergency. Nothing in the report says it steals data.

The facts at a glance

Product	Affected	Fixed
Android 12 and 13	Vulnerable; did not receive the fix	No fix reported
Android 14 through 17	Phones without the October 2026 security update	October 2026 Android security update

These details come from BleepingComputer’s report, which draws on the researcher’s published analysis. We did not find a Google advisory to link, since the report says the flaw is missing from Google’s October bulletin. If Google says more, we will update this post.

The report says the public exploit can send the bad messages from another Android device. That makes it easier for others to copy.

Why this one matters around here

Many small offices in Orting, Puyallup, Sumner and Buckley run on staff phones. Some are personal phones, and some are hand-me-downs. Older phones tend to stay in drawers, in vans and in kids’ hands.

A crashed work phone on a job site means missed calls and missed login codes. A phone stuck in a reboot loop could mean losing whatever was not backed up. Think photos, notes and texts.

The report says Android security updates are generally installed automatically on supported devices, but availability depends on the phone’s maker. That is the catch. A phone that no longer gets updates stays open to this bug.

If you have not looked at your office’s phones lately, our office security checklist is a good place to start.

What to do this week

• Check your Android version. Open Settings, then About phone. Look for the Android version. Menus differ by brand, so search “Android version” in Settings if you can’t find it.
• Check the security update date. On the same screen, look for “Android security update.” You want October 2026 or later.
• Install any pending update. Go to Settings, then System or Software update, and tap check for updates. Do this on Wi-Fi with the phone charged.
• Plan to replace Android 12 and 13 phones that can’t update. If the maker no longer sends updates, the phone is not safe for work use. Move it to non-critical use or retire it.
• Back up your phone. Photos, contacts and texts should live somewhere other than the phone. A factory reset is the worst case here, so make it painless.
• Have a backup way to call for help. Don’t rely on one phone for emergencies. A landline or a second phone on a different carrier helps while service is down.

The report mentions a way to remove the bad messages, but it needs a computer and advanced technical skills. If your phone is stuck in a loop, don’t try to repair it alone. Call someone who does this for a living.

If you are not sure which of your team’s phones and computers are up to date, we are happy to look. Our free 30-minute assessment shows what to fix first. There is no cost and no contract, and it can be remote or on-site. You can book it here. You can also read how we protect office computers.

Sources

• New Android SMS of Death exploit can remotely crash unpatched phones (BleepingComputer)

This article was drafted by Percival, Rainier IT’s AI writing assistant, from the sources linked above, and reviewed by Christopher Engelhardt before publication. Spot an error? Email [email protected].