Android SMS of Death Fix Skips Android 12 and 13 Phones

Google has rated the Android SMS of Death flaw critical and shipped the fix at security patch level 2026-11-01. The bug, tracked as CVE-2026-58882, lets a single malformed text crash a phone’s calling service and drop calls in progress, emergency calls included. The November bulletin lists Android 14 through 17 as covered.

What the SMS of Death Does to a Phone

It crashes the part of Android that handles phone calls, without the owner touching anything. The attack needs one specially built WAP Push message, an old carrier mechanism for sending instructions to a handset without user action, such as triggering an MMS download or pushing carrier settings.

The malformed message never reaches the inbox. According to security researcher Mark Blaszczyk, who found the flaw and named it, a manipulated length value in the message header becomes a negative array size, and the unhandled exception takes down the com.android.phone process that runs telephony.

Three consequences follow, and they are what make a denial-of-service bug worth paying attention to.

• Calls drop: Any call in progress ends when the process crashes, and Blaszczyk reports that this includes emergency calls.
• The crash repeats: Android retries the same unprocessed message after each restart, which Blaszczyk measured as a reboot loop roughly every 90 seconds.
• It persists: Carriers redeliver messages that were never acknowledged, so in the researcher’s tests a single message produced outages lasting up to a week. He puts the figure at around 20 messages to render a handset practically unusable.

Blaszczyk reported a 100% reproduction rate, including on a Pixel 9 and several Samsung Galaxy models. This is a disruption bug and nothing more: it does not read messages, steal credentials or take data off the device.

Which Android Versions Get the Fix, and Which Do Not

The November bulletin covers Android 14 to 17. Google’s own entry for CVE-2026-58882 classifies it as a critical denial-of-service issue in the System component and lists the affected versions as Android 14, 15, 16, 16-qpr2 and 17.

The vulnerable code is older than the fix list suggests. Blaszczyk says the defect reaches back to Android 12, and because Google has ended security support for Android 12 and 13, heise reported on 30 October 2026 that those versions will most likely stay unpatched unless an individual manufacturer backports the change itself. Anyone still running Android 13 or earlier has no update to wait for.

How to Check Whether Your Phone Is Patched

You are looking for a security patch level dated 1 November 2026 or later. The Android version number alone does not tell you.

1. Open Settings and tap About phone.
2. On a Pixel, tap Android version, then read the Android security update field. On a Samsung Galaxy, tap Software information and read Security patch level.
3. If the date shown is 1 November 2026 or later, the fix is installed.
4. If it is older, go to Settings, then System, then Software update, and check for an update.
5. If no update is offered, the fix has not reached your model yet. Patches are distributed by the device maker and the carrier, not by Google directly, so the wait varies by handset, as the staggered OnePlus rollout of Android 17 showed in October.

An October 2026 patch level may already protect you. Blaszczyk and Google’s November bulletin do not agree neatly here: the researcher says the code fix shipped to Android 14 through 17 in October updates, while the bulletin is the first time Google has formally published it with a severity rating. A patch level of 2026-11-01 or later is the version you can verify against Google’s own list.

As of 4 November 2026, Samsung has published its November bulletin, which carries Google’s Android fixes alongside 24 of Samsung’s own Galaxy patches, but the rollout to Galaxy handsets had not begun. Samsung says updates tagged with the November 2026 patch level will reach devices over the following weeks.

Why Blocking the Sender Does Not Help

There is no setting that stops this message. A WAP Push message is processed by Android’s telephony framework before it ever reaches the Messages app, so a block list, a spam filter and a silenced-unknown-callers setting all act too late. Android exposes no toggle to refuse WAP Push, unlike the 2G switch Google has urged users to turn off to shrink the same telephony attack surface.

That is the reason the patch level is the only answer worth giving. Advice to avoid opening suspicious texts does not apply to a message that is never shown and never opened.

What to Do if a Phone Is Already Looping

Do not choose “Wipe data” if a recovery prompt appears. A device caught in this loop has a pending message that a factory reset will not necessarily clear, because the carrier can redeliver it, so wiping may cost all the data on the phone and fix nothing.

Recovery, as Blaszczyk describes it, means connecting the handset to a computer over the Android Debug Bridge and deleting the offending entries from the raw SMS store. That requires developer options and USB debugging to have been enabled beforehand, which rules it out for most owners. For anyone without that setup, the practical route is the manufacturer’s support channel or a service centre.

How Google Handled the Report

The disclosure ran for almost six months before the bulletin settled it.

• 5 May 2026: Blaszczyk reports the flaw to Google.
• 15 June 2026: Google creates a fix, choosing broader exception handling over the header validation the researcher had proposed.
• July 2026: GrapheneOS, a security-focused Android distribution, says Google supplied the patch through security previews and implements it.
• October 2026: The fix reaches the public AOSP repository and ships to Android 14 through 17, but is left out of the October bulletin.
• 29 October 2026: Blaszczyk publishes the flaw and proof-of-concept code, saying Google had closed his report as a non-security issue.
• 2 November 2026: Google’s November bulletin lists CVE-2026-58882 as critical at patch level 2026-11-01.

Google has not published a statement on why the report was closed. GrapheneOS has suggested it may have been an internal mix-up over a duplicate, which remains an explanation offered by a third party rather than anything Google has confirmed.

The November bulletin is a large one either way. It also fixes CVE-2026-58868, a critical remote code execution flaw in the Android Framework affecting the same versions, and devices at patch level 2026-11-05 or later carry everything in the bulletin rather than the first tranche alone.

Frequently Asked Questions

Is the Android SMS of Death Being Used in Real Attacks?

There is no confirmed case. Google’s November bulletin says nothing about exploitation of CVE-2026-58882, and Spain’s INCIBE cyber security agency lists it as not exploited. Proof-of-concept code is public, which lowers the barrier for anyone who wants to try it.

Can This Flaw Steal My Data?

No. It is a denial-of-service bug that crashes the telephony process. It does not grant access to messages, accounts, files or passwords.

Which Security Patch Level Fixes It?

2026-11-01 or later, according to Google’s bulletin. The researcher who found the flaw says the code fix also went out in October 2026 updates for Android 14 through 17, so an October patch level may already include it.

What Can I Do on Android 12 or 13?

Very little. Google no longer issues security updates for those versions and the November bulletin does not list them, so a fix would have to come from the device maker. Moving to a supported device is the only reliable answer.

Will a Factory Reset Clear It?

Not reliably. The carrier can redeliver the message that caused the crash, which can restart the loop on a freshly reset phone. Avoid the “Wipe data” option at a recovery prompt for that reason.