Google’s November 2026 Android Security Bulletin, published November 2, 2026, rates CVE-2026-58882, the bug nicknamed “SMS of Death,” as a Critical denial-of-service flaw and lists fixes for Android 14, 15, 16 and 17. Phones that haven’t received that fix are open to it. The flaw sits in Android’s built-in phone service, the background part of the system that handles your calls. Late in October, a security researcher released working attack code showing that one hidden, malformed text message can crash that service, according to BleepingComputer.
Here’s the short answer to the question you’re probably asking. Based on current reporting, this bug can drop your calls and crash your phone’s calling feature. No data theft or spyware capability has been reported or established for it.
Google’s bulletin lists the CVE in its 2026-11-01 patch section and says security patch levels of 2026-11-05 or later address every issue in the November bulletin. As a general signal, a patch level of 2026-11-05 or later should include the fix, but Google’s bulletin describes Android Open Source Project (AOSP) fixes and each maker builds its own updates, so your phone maker’s security bulletin is the final word for your model.
Earlier reports said the code fix shipped in October updates before the CVE was documented; the November bulletin is now the official reference. Google’s bulletin lists fixes only for Android 14 through 17. Android 12 and 13 fall outside those listed fixes; the researcher says they’re affected too, and Google no longer supports them, so any fix for them would have to come from your phone maker.
Your best move right now is to install any pending system update and confirm your security patch level reads 2026-11-01 or later (the patch section that lists this CVE).
Quick Reference: Where Things Stand
| Question | Short answer (per Google’s Nov 2, 2026 bulletin and reporting) |
|---|---|
| What is it? | A zero-click bug that crashes Android’s phone/calling process |
| Do I see the message? | No. It never shows up in your inbox |
| Can it steal data or install malware? | No such capability has been reported |
| What can it do? | Drop calls, disrupt calling; repeated messages may cause repeated crashes |
| Is it fixed? | Yes. Google’s November 2026 bulletin lists the fix for Android 14–17; patch level 2026-11-05 or later covers every November fix |
| Who may still be exposed? | Phones without the November 2026 patch, including phones that no longer get updates. Android 12 and 13 aren’t among the versions Google lists fixes for, and the researcher says they’re affected |
| Any real-world attacks? | None publicly reported in the coverage we reviewed; Google’s bulletin doesn’t flag it as exploited |
| What should I do? | Install updates, then check your security patch level |
What Happened
Security researcher Mark Blaszczyk published a proof-of-concept exploit (a working demo of the attack) for a newly disclosed Android flaw tracked as CVE-2026-58882. Its nickname is “SMS of Death,” and that’s dramatic, but fair. Coverage from BleepingComputer, heise online, Security Affairs, and Tech-ish describes the same core facts.
What Is the Android SMS of Death Exploit?
In plain English, it’s a broken text message that confuses your phone so badly that the calling part of Android crashes.
The message isn’t a normal text like “running late, be there in 10.” It’s an old-school type of message called a WAP Push. Think of it as a behind-the-scenes text that phones once used to receive setup info or links. You never see these messages. Your phone handles them quietly in the background.
The bug lives in the code that unpacks WAP Push messages. The public CVE record describes an integer overflow that causes an out-of-bounds read in decodeWapPdu of WapPushOverSms.java, leading to remote denial of service with no additional privileges or user interaction needed. Reporting says that crash takes down com.android.phone, the system process that runs your calls.
A few key points from the reporting:
- It’s zero-click. You don’t have to open, tap, or even notice anything. The crash happens before any message could appear.
- It’s tiny. The public demo reportedly uses a very short, malformed message, nowhere near the length of a normal text.
- The attacker needs your phone number. Coverage describes that as the main requirement, though the message also has to get through the carrier network.
- It’s repeatable, and it can persist. The researcher says, as reported by heise online, that Android reprocesses the same malicious message after every restart and that carriers resend messages that weren’t confirmed as delivered. In his account, that’s how a single text can keep crashing the phone.
That last point is the most disruptive part. Per heise online, the researcher says an unpatched phone can end up restarting about every 90 seconds and showing a recovery-mode prompt to erase data, that around 20 messages can nearly disable a phone, and that in his tests one text caused outages for up to a week. He reproduced it on a Pixel 9 and several Samsung Galaxy phones. These details come from the researcher’s own testing and haven’t been independently verified on every device.
What It Does (and Doesn’t) Do
This is the part that should lower your blood pressure a bit. Based on all available reporting, the SMS of Death is a denial-of-service bug. That’s security-speak for “it breaks something so you can’t use it.” It isn’t a break-in.
What it can reportedly do:
- Crash the phone process: The background service that handles calling goes down.
- Drop active calls: If you’re on a call when it hits, the call can end.
- Disrupt emergency calls: Security Affairs reports that a crash during an active or attempted emergency call could, in theory, disrupt it too — a reported risk rather than something independently demonstrated on every device. If an emergency call ever fails to connect, switch immediately to another phone or another way to reach help.
- Cause repeated crashes or a restart loop: Per the researcher’s account, the message is reprocessed after each restart, which can leave some phones in a restart cycle until the phone is repaired.
What it reportedly does not do:
- Steal your photos, messages, or passwords. No data theft capability has been reported or established for this vulnerability.
- Install spyware or malware. No such capability has been reported or established; Google’s bulletin classifies it as denial of service.
- Give someone control of your phone. This isn’t a device takeover.
So it’s less “burglar in your house” and more “someone who keeps flipping your circuit breaker.” That’s annoying and potentially dangerous in an emergency, but your stuff stays put.
The Timeline
Here’s how things played out, based on secondary reporting:
- May 5, 2026: Blaszczyk reported the bug to Google, according to heise online, which also reports Google created a fix on June 15.
- Before public disclosure: Google reportedly fixed the underlying code internally.
- October 2026: Secondary reports said a code fix shipped for Android 14 through 17 in that month’s updates, though the CVE wasn’t listed in Google’s October 2026 security bulletin.
- October 29, 2026: The researcher disclosed the flaw and published the proof-of-concept code.
- November 2, 2026: Google published its November 2026 Android Security Bulletin, listing CVE-2026-58882 (A-517376969) as a Critical denial-of-service issue in the System component for Android 14, 15, 16, 16 QPR2 and 17, in its 2026-11-01 patch section.
Google’s bulletin confirms the CVE and its Critical rating, and the public CVE record (checked again via the CVE Services API on November 4, 2026) carries the same description and lists Android 14, 15, 16, 16 QPR2 and 17 as affected AOSP versions. When the fix reaches a given phone still depends on its maker. The researcher’s disclosure history and the exact internal fix dates still come from secondary reporting, not from Google directly.
Vendor rollout still varies by device, so the practical check is your phone’s security patch level: Google says 2026-11-05 or later addresses every issue in the November bulletin. Your phone maker’s own security bulletin is the definitive confirmation for its builds.
Who This Affects
This story is about Android phones. No iPhone impact has been reported in available coverage, though that isn’t a formally confirmed cross-platform finding.
| Android version | Fix status (per Google’s November 2026 bulletin) | Notes |
|---|---|---|
| Android 17 | Listed as fixed in the November 2026 bulletin | Depends on your maker/carrier pushing that update |
| Android 16 (incl. QPR2) | Listed as fixed in the November 2026 bulletin | Same caveat |
| Android 15 | Listed as fixed in the November 2026 bulletin | Same caveat |
| Android 14 | Listed as fixed in the November 2026 bulletin | Same caveat |
| Android 13 | No fix listed in Google’s bulletin | Researcher says it’s affected; no longer supported by Google, so check with your phone maker |
| Android 12 | Not listed in Google’s bulletin | Same as Android 13 |
| iOS | No impact reported in available coverage | N/A |
Sources: Google’s November 2026 Android Security Bulletin and the CVE record (retrieved November 3, 2026); BleepingComputer and heise online for the researcher’s account.
Why Your Patch Level Matters More Than Your Android Version
Here’s the tricky part. Running Android 15 doesn’t automatically mean you’re protected.
Google writes the fix, but Samsung, Motorola, OnePlus, and your carrier decide when it actually reaches your phone. How long that takes varies by maker, model and carrier. Some phones stop getting updates altogether.
So the number that really matters is your Android security patch level. That’s a date in your settings showing how current your security fixes are. It’s like the “best by” date on milk. The version number tells you what kind of milk it is. The date tells you whether it’s fresh.
Google’s November bulletin lists CVE-2026-58882 in its 2026-11-01 patch section and says patch levels of 2026-11-05 or later address all of the bulletin’s issues. Treat the date as a general signal: a date before November 2026 means the fix almost certainly hasn’t reached your phone, and 2026-11-05 or later should include it. Because each maker builds its own updates, your phone maker’s security bulletin or changelog is the definitive confirmation for your specific model.
Android 12 and 13 aren’t among the versions Google lists fixes for. That means no Google fix is listed for them, not that they’re confirmed safe or confirmed vulnerable on every model. The researcher says they’re affected, and heise online reports they’ll likely stay unpatched unless phone makers develop their own fix, since Google no longer supports them. If your phone runs one of them, check your phone maker’s security page.
Has Anyone Actually Been Attacked?
Not that anyone has publicly reported. As of November 3, 2026, no real-world attacks using CVE-2026-58882 have been reported in the coverage we reviewed, and Google’s bulletin doesn’t flag it as exploited. That isn’t a guarantee none have occurred.
The news is that attack code is now public, not that a wave of attacks is underway. That distinction matters. Public proof-of-concept code lowers the barrier for potential attackers, which is another reason to patch promptly. But there’s no reason to panic or assume your phone has already been hit.
How It Stacks Up
Normally this section compares a product against its rivals. This is a security bug, not a product, so there’s no competitor lineup or benchmark chart to compare.
The more useful comparison is with itself across Android versions (see the table above). Google’s bulletin covers Android 14 through 17. Phones without a maker-provided fix are the practical weak spot, especially Android 12 and 13 devices: the researcher says the vulnerable code goes back to Android 12, and heise reports Google no longer supports those versions. That’s the familiar Android story. Google can fix a bug quickly, but the fix only helps if it actually lands on your phone.
It also helps to compare this bug with the scarier security headlines you’ve probably seen. Zero-click spyware attacks can quietly read your messages. This one can’t, based on what’s been reported. In this case, “zero-click” means no interaction is needed. It doesn’t mean the attacker gets your data.
The Reaction
Public reaction is still forming. We couldn’t find any linkable posts or community discussion threads that we could verify and cite. For now, most of the conversation is people sharing the security-press coverage linked above.
What to Do Next
There’s one practical step here: get the latest update, then confirm your patch level. No app or setting has been reported to block this exploit, based on available coverage, though that isn’t an exhaustive review of every device-specific option. The official system update is the most reliably confirmed fix.
One safety note worth repeating: if you ever attempt an emergency call and it fails to connect or drops unexpectedly, don’t keep retrying on the same phone. Switch immediately to another phone or another way to reach help.
Menu names vary by phone maker, so look for similar wording if yours doesn’t match exactly.
Step 1: Check for a System Update
- Open the Settings app.
- Look for System > Software update, System update, or Software update near the bottom of the list. The location depends on your phone maker.
- Tap Check for update (or similar) and install anything that’s waiting.
Step 2: Check Your Security Patch Level
- In Settings, tap About phone (some phones call it Software information).
- Look for Android version and tap it if needed.
- Find the Android security patch level or Android security update field. It shows a date.
If the date is 2026-11-05 or later, Google says that patch level addresses every November bulletin issue, including this one; your maker’s security notes confirm it for your model. If it’s older and no update is available, your phone may still be exposed. Your phone maker’s security page can confirm the status of its own builds.
If Your Phone Keeps Dropping Calls or Rebooting
Dropped calls and crashes have a lot of possible causes. Weak signal, carrier trouble, flaky hardware, and plain old bugs are all far more common than this exploit. Reporting doesn’t give a symptom checklist unique to this attack. Install the latest update first.
If your phone is stuck restarting and shows a recovery screen offering to wipe data, the researcher warns against choosing “Wipe data,” which erases everything; he says recovery is possible by connecting the phone to a computer with Android Debug Bridge (ADB), so contact your phone maker or a repair shop before resetting. If problems keep happening, contact your phone maker or carrier support.
If Your Phone No Longer Gets Updates
If your phone runs a version Google’s bulletin doesn’t list, such as Android 12 or 13, or has stopped receiving updates, there’s no reported workaround. The realistic risk is disrupted calling, not data theft. Still, a phone you can’t count on during an emergency call isn’t great.
If you ever need emergency help and a call doesn’t connect, try again immediately from a different phone or another communication method rather than repeating attempts on a phone that may be crashing.
If your device is past its update life, this is a good nudge to look at a newer Android phone with a long update commitment, such as a recent Google Pixel or Samsung Galaxy. When you shop, check each maker’s published update policy before you buy.
Our Take
Who should care: Anyone with an Android phone, but especially people whose phones no longer get security updates, people with older budget phones, parents managing kids’ or grandparents’ devices, and small businesses that rely on company phones for calls.
Who can relax a little: If you’re on Android 14 or newer and your security patch level is 2026-11-05 or later, you should be covered under Google’s bulletin; your maker’s security notes confirm it for your model.
What it means: This is a real, easy-to-trigger bug with public attack code, and that’s enough reason to update today. But the evidence points to disruption, not a privacy disaster. Nobody’s reading your texts through this. The worry is losing the ability to make calls, including, according to reporting, emergency ones, at a bad moment.
Our honest opinion? The fix itself appears to have been handled reasonably well. Google reportedly patched the underlying code before the proof-of-concept code went public. The weak link is the usual one: older Android phones getting left out. If your phone no longer gets security updates, this story is a good reason to plan your next upgrade.
Wrapping Up
The SMS of Death sounds terrifying, but the reported reality is narrower. It’s an invisible message that can crash your phone’s calling feature on unpatched devices. No data theft capability has been reported. Install your updates and look for a security patch level of 2026-11-05 or later, or your maker’s confirmation.
| Step | Action | Applies To |
|---|---|---|
| 1 | Install any pending system update | All Android phones |
| 2 | Look for a security patch level of 2026-11-05 or later, then check your maker’s notes | All Android phones |
| 3 | Look for a maker-specific security note if unsure | Samsung, Motorola, OnePlus, etc. |
| 4 | Consider upgrading if updates have stopped | Phones that no longer get security updates |