A newly disclosed Android vulnerability nicknamed the SMS of Death bug can silently knock out a phone’s ability to make or receive calls, and in the worst cases, it never even shows up in your messaging app. Security researcher Mark Blaszczyk found that a specially crafted text message can crash the part of Android that handles phone calls, cutting off conversations in progress, including calls to emergency services, without the victim doing anything at all.
How the attack works
Unlike a typical spam or phishing text, the malicious message never lands in your inbox, so there’s no notification or suspicious sender name to tip you off. Instead, it exploits a weakness in how Android processes certain SMS content, crashing the calling service outright. Because the phone can keep trying — and failing — to process the same message, the crash can repeat itself. Blaszczyk says roughly 20 of these messages are enough to leave a device barely usable, potentially stuck in a reboot loop.
Recovering isn’t always as simple as restarting the phone, either. If a carrier resends the offending messages, even a factory reset might not help for long. In some cases, clearing the problem requires connecting the phone to a computer to manually remove the messages, which is well beyond what most people can handle on their own.
Which phones are affected
Blaszczyk successfully reproduced the crash on both Google Pixel and Samsung Galaxy devices. The vulnerable code reportedly traces back to Android 12, meaning the exposure depends heavily on whether a given phone has received the patch. Devices running older Android versions that no longer get security updates are the most at risk, since there’s no fix coming for them at all.
Google’s confusing response
Blaszczyk says he first reported the issue to Google back in May, only to have it repeatedly dismissed as a non-security problem. Frustrated, he published his findings and a working demonstration in late October. It turns out Google had already built a fix by mid-June that catches the error and removes the offending message before it can cause repeat crashes. GrapheneOS has said Google distributed that fix through security previews back in July, months before the public disclosure.
The flaw is now tracked as CVE-2026-58882 with a Critical severity rating and is expected to appear in November’s Android Security Bulletin. Why Google’s own team seemed unaware of a fix its engineers had already shipped isn’t clear; an internal mix-up involving a duplicate report is one possibility, though Google hasn’t explained the discrepancy publicly.
When you’ll get the patch
According to Blaszczyk, the fix was included in October’s security updates for Android versions 14 through 17. GrapheneOS, on the other hand, points to November’s bulletin as the official rollout, having already received the underlying fix earlier through previews. Those two timelines aren’t necessarily contradictory, since manufacturers often get fixes ahead of the public bulletin, but exactly when it reaches individual phones is still murky. If you own a Samsung Galaxy phone running Android 17, checking for the latest update is the most direct way to confirm you’re covered.
The bottom line
The SMS of Death bug is a reminder that not every threat to your phone announces itself with a suspicious link or a sketchy app. In this case, a single unseen message could interrupt an emergency call, which makes patching a priority rather than an afterthought. The safest move right now is simple: open your phone’s settings and install whatever Android security update is available, regardless of which brand you carry.
Source: Android Authority
Where to buy
As an Amazon Associate I earn from qualifying purchases.
