A researcher has published a working proof-of-concept for CVE-2026-58882, an Android flaw that lets a single malformed text message crash a phone’s telephony process with no action from the owner. Android 12 and 13 devices remain unpatched, and the same message can drop calls in progress, including emergency calls.
How CVE-2026-58882 Crashes the Android Phone Process
Researcher Mark Blah, named Blaszczyk in one other write-up, released a technical analysis and exploit for the zero-click denial-of-service bug on October 31. The flaw sits in the WapPushOverSms.decodeWapPdu function in Android’s telephony stack.
The function parses a WSP header length as a 64-bit uintvar and then casts it to a 32-bit integer without checking bounds. A crafted value turns negative after the cast and triggers an unhandled NegativeArraySizeException, which crashes the com.android.phone process.
The Eight-Byte WAP Push Message Sent to Port 2948
Triggering the bug takes one malformed eight-byte WAP Push message delivered as a data SMS to port 2948. The device processes the message before it reaches the inbox, so the target never sees it and does not need to tap anything. An attacker needs only the victim’s phone number.
When the phone process crashes, ongoing calls drop. That includes emergency calls, which makes the flaw more serious than a routine handset crash on affected devices.
Roughly 20 Messages Can Trap Phones in Reboot Loops
Sending a small batch of about 20 messages can put a phone into a reboot loop. Carriers redeliver messages the handset has not acknowledged, and Android reprocesses messages it has already stored, so each restart hits the malformed payload again.
On one Android 12 device used in testing, the phone rebooted into recovery roughly every 90 seconds and needed a factory reset to recover. A GitHub contributor has since found a workaround using ADB that removes the offending messages, which gives affected users a path that avoids wiping the device.
Patch Status for Android 12 Through Android 17
Google reportedly fixed the flaw in its October 2026 Android updates for Android 14 through 17, but the issue is not listed in the October security bulletin. Android 12 and 13 devices remain vulnerable, and no fix has been announced for them. The researcher criticized Google’s remediation timeline.
Why the Missing Bulletin Entry Complicates Patch Verification
The gap between a fix shipping and a bulletin listing it matters for administrators who track Android exposure by CVE. Anyone checking the October bulletin for CVE-2026-58882 will not find it, even on devices that now carry the correction. The patch status for Android 14 through 17 is described as reported, not confirmed in the bulletin.
The exploit’s public release changes the position of Android 12 and 13 owners, since the proof-of-concept and write-up are now available and the attack requires only a phone number. The redelivery behavior that makes the reboot loop persistent also means the damage can outlast the first message. Whether Google extends a fix to the two older Android versions is the open question that will determine how long those handsets stay exposed.
The affected component is the telephony stack rather than a third-party app, which is why the crash takes down calling itself. The researcher’s published write-up gives the parsing error in specific terms: a length value read as a 64-bit uintvar, narrowed to 32 bits and left unchecked. Because Android handles the message before it reaches the inbox, standard user-side defenses such as ignoring unknown senders do not apply. The ADB workaround found by a GitHub contributor requires a connection to the device, so a phone caught in a rapid reboot cycle may be hard to reach before the next crash.
