Researcher Mark Blah released a technical write-up and PoC on Oct 29 for a bug nicknamed "SMS of Death", which he tracks as CVE-2026-58882 (the CVE record was not yet published when we checked).

• Trigger: an eight-byte WAP Push message sent as a data SMS to port 2948. A header-length value is read into a signed 32-bit integer without a bounds check, and the resulting negative allocation throws NegativeArraySizeException in WapPushOverSms.decodeWapPdu, crashing com.android.phone.
• Effect: no user interaction and nothing visible in the SMS inbox. The phone loses cellular connectivity and active calls (including emergency calls) drop; carrier redelivery and stored messages can repeat the crash. The researcher reports reboot loops after about 20 messages on test devices.
• Fix: Google's AOSP commit 735d967 in platform/frameworks/opt/telephony, "Fix remote DoS in decodeWapPdu (b/517376969)", catches RuntimeException during WAP push decoding and SMS broadcast and deletes the poison tracker from the raw SMS table. It is not listed by name in Google's October 2026 Android Security Bulletin.
• Coverage: the researcher and reporting say the fix shipped in the October 2026 security releases for Android 14 to 17, and that Android 12 and 13 remain vulnerable. Treat that as the researcher's account until Google says more.

What to do: push the October 2026 (or later) security patch level to managed Android fleets and ask OEMs or carriers to confirm that the build includes the decodeWapPdu fix, since the patch level alone may not prove it. Plan to retire Android 12/13 devices in roles where losing cellular service matters (on-call phones, field staff). Carriers can filter malformed WAP Push PDUs to port 2948 in the network.