A single short message invisible to users can render Android smartphones unusable and even interrupt emergency calls in progress. According to his own account, the security researcher Mark Blaszczyk made this public on Thursday, 29 October, as the IT specialist portal heise.de reports. According to heise.de, the Android versions 12 to 17 are apparently affected.
The vulnerability now carries the identifier CVE-2026-58882 and is classified by Google as critical. Blaszczyk himself speaks of “a remote-controlled, zero-click denial-of-service attack with a lasting effect” – he is quoted by heise.de. Zero-click means: nobody has to tap a link or install an app. The mere technical processing of the message triggers the error, as the Süddeutsche Zeitung explains.
How one message paralyses the phone
The attack runs via the outdated WAP push system, with which mobile network operators send hidden instructions to devices – for example to take over network settings. According to heise.de, Android converts a manipulated length value in the WSP header into a negative array size. The result is an unhandled NegativeArraySizeException, and the telephony service “com.android.phone” crashes. winfuture.de describes the same mechanism as a missing bounds check in the file “WapPushOverSms.java”.
For those affected this is hard to notice: the messages do not appear in the inbox. If the error is not fixed, according to heise.de the smartphone reboots about every 90 seconds; web.de and the WirtschaftsWoche cite around one and a half minutes. In addition, a prompt appears to delete the data in recovery mode. Anyone who selects “Wipe data” there loses all data on the device – all sources strongly advise against this.
According to his own account, Blaszczyk was able to reproduce the error 100 per cent, among other things on a Pixel 9 and various Samsung Galaxy devices. Network operators redeliver unconfirmed messages, so the crash repeats. In his tests, a single SMS caused outages for up to a week; about 20 such messages could make a smartphone practically permanently unusable, according to the researcher.
Patch for Android 14 to 17 – and what applies to older devices
According to heise.de, Google has already reacted: the researcher informed the company on 5 May, on 15 June a fix was created, which was apparently checked in on 5 August and only transferred publicly to the Android Open Source Project in October. According to the GrapheneOS project, Google made the patch available via security previews as early as July. In October a security patch for Android 14 to 17 followed, but it was not published in the October bulletin; the flaw is to be listed as critical in the November bulletin.
The catch: security updates are usually distributed by the device manufacturers. Anyone who does not own a Pixel smartphone may, according to web.de and WirtschaftsWoche, wait weeks or even months for the patch. On devices with Android 12 or 13, the flaw will in all likelihood remain, according to the sources, because Google no longer supports these versions – unless a manufacturer develops a fix itself. The Süddeutsche Zeitung stresses that the Android version number alone says nothing about whether a device is protected; what matters is whether the fix has actually been installed.
The background is remarkable: Google initially closed the researcher’s bug report as “Will Not Fix”. On X, GrapheneOS speculates that the report may have been mishandled – for example as a duplicate instead of as “WONTFIX”. heise.de classifies this as a possible internal communication glitch.
What those affected can do now
Anyone who wants to free their device from the reboot loop should, according to Blaszczyk, connect it to a computer and use the developer tool Android Debug Bridge (ADB). Via the command line, the faulty messages can be deleted from the queue in the short window after a reboot, winfuture.de describes. Without this step the device remains practically locked.
- Regularly check in the settings under “System/Software updates” or similar whether a security update is available.
- Under no circumstances select “Wipe data” in the recovery menu.
- A backup does not prevent an attack, but can avoid data loss in a later restoration, as the Süddeutsche Zeitung notes.
- Antivirus apps, VPN services and password managers cannot, in the assessment of the Süddeutsche Zeitung, replace a missing system patch.
winfuture.de also points to possible regulatory consequences in Australia: there, mobile network operators must block devices that cannot reliably reach the emergency call. An attacker could therefore remotely cause a provider to disconnect an affected smartphone from the network after 28 days. According to the Süddeutsche Zeitung, a direct theft of photos, passwords or bank data through the vulnerability is not documented.
Editor’s note: Whether and when German manufacturers will deliver patches for older devices does not emerge from the available sources. Users should keep an eye on their device’s update display.
