CVE-2026-58882: How to Detect & Patch Android SMS Crash Flaw

Executive Summary

A critical zero-click denial-of-service vulnerability tracked as CVE-2026-58882 (popularly dubbed the "SMS of Death") has been disclosed with public proof-of-concept (PoC) exploit code affecting unpatched Android mobile devices. The security flaw allows remote adversaries to instantly terminate mobile connectivity, disconnect ongoing telephone conversations—including emergency service calls—and force vulnerable smartphones into persistent reboot or recovery loops simply by transmitting a specially crafted text message.

Because the vulnerability is processed at the operating system framework level before reaching the user's messaging application or inbox, target devices execute the malicious payload with zero user interaction and provide no visual notification of the incoming attack. Enterprise mobility management (EMM) administrators, telecom security engineers, and mobile fleet operators must verify that Android devices running OS versions 12 through 15 are updated with official vendor security patches.

Technical Vulnerability Analysis & Attack Chain

The root cause of CVE-2026-58882 resides within the Android Telephony framework, specifically inside the WapPushOverSms.decodeWapPdu function responsible for parsing Wireless Application Protocol (WAP) Push messages received over cellular SMS transport channels.

When an incoming data SMS targeted at UDP port 2948 is received by the modem baseband, Android routes the raw Protocol Data Unit (PDU) directly to the com.android.phone system process. The vulnerable parsing logic extracts an 8-byte header-length descriptor:

01 06 88 80 80 80 00 BE   --> sent as raw data SMS to UDP port 2948

During header deserialization, the parsing routine converts this multi-byte unsigned value into a signed 32-bit integer without enforcing upper or lower boundary bounds checks. Under specific bit configurations, this arithmetic cast results in an integer underflow representing the minimum signed 32-bit value:

Signed 32-bit integer conversion: -2147483648 (0x80000000)

When the framework subsequently attempts to allocate a buffer array using this signed negative dimension, the Java Virtual Machine throws an unhandled java.lang.NegativeArraySizeException. Because this exception occurs within the core com.android.phone system process, the entire telephony daemon terminates abruptly.

As the com.android.phone daemon manages the Radio Interface Layer (RIL) connection, SIM card state, and cellular baseband communication, its crash immediately severs mobile network registration. Furthermore, when telecom carriers attempt to redeliver the unacknowledged SMS or when Android repeatedly attempts to reprocess unparsed messages stored in SIM/eUICC cache, devices can enter repeated crash cycles, requiring a hardware recovery factory reset.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Exploitation Telemetry

Following public technical analysis and release of functional proof-of-concept scripts, the barrier to weaponization has dropped significantly. Adversaries with access to commercial SMS gateways, programmable SIM modems (e.g., SIM800/SIM900 cellular modules), or compromised carrier SMPP connections can script automated mass transmissions against target mobile phone numbers.

• Vulnerable Component: frameworks/opt/telephony/src/java/com/android/internal/telephony/WapPushOverSms.java
• Affected Functions: decodeWapPdu()
• Target Process: com.android.phone
• Transport Vector: Data SMS directed to WAP Push Application Port 2948
• Observed Blast Radius: Immediate crash of cellular radio interface; tested devices running unpatched Android 12 through 14 exhibited recurring recovery mode reboots requiring manual factory wipes after receiving burst deliveries of 20 messages.

Detection & SOC Mitigation Playbook

1. Carrier & MDM Mobile Fleet Hardening

• Enterprise Patch Attestation: Enforce Android security patch level verification across all corporate-managed devices via Microsoft Intune, Google Workspace MDM, or VMware Workspace ONE. Devices must be on the official security patch level addressing CVE-2026-58882.
• Telecom Carrier Filtering: Upstream telecom providers and private APN operators should implement packet inspection on Short Message Peer-to-Peer (SMPP) gateways to drop WAP Push PDUs targeted at port 2948 exhibiting illegal length headers (01 06 88 80 80 80 00 BE).

2. Host-Level Behavioral Hunting (Android Logcat)

Security engineers auditing enterprise mobile devices or conducting forensic triage can identify exploitation attempts by querying Android logcat for telephony process fatal crashes:

# Filter Android system logcat for CVE-2026-58882 crash signatures
adb logcat -d | grep -E "(NegativeArraySizeException.*WapPushOverSms|Fatal signal.*com.android.phone)"

3. Endpoint Detection & Hunting Query

Sigma Rule (Telecom Gateway & Android Log Pipeline)

title: Android WapPushOverSms Zero-Click DoS Crash
id: e8a25c19-9142-4f9e-b7d1-58882a991404
status: experimental
description: Detects fatal telephony process termination caused by NegativeArraySizeException in WapPushOverSms during WAP Push PDU processing (CVE-2026-58882).
references:
  - https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/?ref=cybernewsai.com
author: CyberNewsAI Threat Research Team
date: 2026-10-31
logsource:
  category: application
  product: android
detection:
  selection:
    log.message|contains:
      - 'NegativeArraySizeException'
      - 'WapPushOverSms'
      - 'com.android.phone'
  condition: selection
falsepositives:
  - Unknown internal OEM telephony testing
level: high
tags:
  - attack.initial_access
  - attack.t1444
  - attack.impact
  - attack.t1499.004

Microsoft Sentinel / Defender KQL Hunting Query

// Sentinel hunting query for Android mobile management log telemetry
DeviceEvents
| where TimeGenerated >= ago(7d)
| where ActionType in ("AppCrashEvents", "SystemProcessCrash")
| where ProcessCommandLine has_any ("com.android.phone", "telephony") or AdditionalFields has_any ("WapPushOverSms", "NegativeArraySizeException")
| extend ErrorDetails = tostring(AdditionalFields.CrashReason)
| where ErrorDetails has "NegativeArraySizeException" or AdditionalFields has "CVE-2026-58882"
| project TimeGenerated, DeviceName, ActionType, ProcessCommandLine, ErrorDetails, ReportId
| order by TimeGenerated desc