Android SMS of Death (CVE-2026-58882): Check Your Security Patch
A zero-click Android flaw nicknamed “SMS of Death” is now officially listed as CVE-2026-58882 in Google’s November 2026 Android Security Bulletin. The issue is classified as a Critical-severity denial of service (DoS): a malformed WAP Push message can crash part of Android’s telephony framework, disrupting cellular service and calls without the owner opening a text. The practical question for phone owners is whether their manufacturer’s update includes Google’s fix—and how to verify that from the security patch date. (Google’s November bulletin; BleepingComputer’s technical report.)
Quick answer: Is your Android phone protected?
For this specific vulnerability, Google’s November bulletin places the fix at security patch level 2026-11-01. A phone showing 2026-11-01 or later is at the AOSP patch level that includes the CVE fix, provided the manufacturer has incorporated that patch into the device firmware. The broader 2026-11-05 level covers all issues listed in the November bulletin.
If your phone shows an earlier patch date—or you cannot find the date—check for a system update and confirm the release notes for your exact model. Android 12 and 13 are not among the updated AOSP versions listed for this CVE, so owners of older phones should ask their manufacturer whether a device-specific backport exists.
Watch on YouTube · Google Help
Tool: Android SMS of Death Patch Checker
Choose the Android version and the security patch date shown in Settings. This checker explains Google’s published AOSP patch level; it cannot remotely inspect your phone or verify a manufacturer’s firmware build.
Select your Android version and security patch date
The result will compare your selections with Google’s November 2026 bulletin and explain what to verify with your phone manufacturer.
What is the Android “SMS of Death” vulnerability?
CVE-2026-58882 is a flaw in Android’s handling of WAP Push messages inside the telephony framework. The researcher who disclosed it calls it “SMS of Death” because a specially malformed message can be processed automatically, before it appears as a normal text in the messaging inbox. That makes it a zero-click issue: the recipient does not have to tap a link, open an attachment or interact with a message.
The reported failure occurs in the WapPushOverSms.decodeWapPdu processing path. An invalid header-length value can cause an exception that crashes the com.android.phone process, which handles core telephony functions. The immediate documented concern is loss of cellular service and dropped calls. The researcher also reported repeated crashes when queued messages were processed again on test devices.
(Researcher’s technical disclosure; BleepingComputer.)
Which Android versions have the fix?
Advertisements
Google’s November 2026 Android Security Bulletin lists CVE-2026-58882 in the System component with type DoS, severity Critical, and updated AOSP versions 14, 15, 16, 16 QPR2 and 17. The entry appears in the section for the 2026-11-01 security patch level. (Google’s November 2026 bulletin.)
| What your phone shows | What Google’s bulletin says | What you should do |
|---|---|---|
| Android 14, 15, 16, 16 QPR2 or 17 Patch level 2026-11-01 | The specific CVE is listed in the 2026-11-01 AOSP patch-level section. | Verify that your phone maker’s firmware includes the November CVE fix, then restart if prompted. |
| Any supported Android version Patch level 2026-11-05 or later | Google says this level or later addresses all issues in the November 2026 Android bulletin, including this CVE. | Keep the device updated. Check your manufacturer’s notes if the device uses a vendor-specific security label. |
| Android 14–17 Patch level before 2026-11-01 | The installed date is earlier than the AOSP patch level in which Google lists this CVE fix. | Do not assume protection from the Android version alone. Check for the latest OEM/carrier update. |
| Android 12 or 13 | These versions are not listed among the updated AOSP versions in Google’s CVE entry. | Ask the manufacturer whether your exact model received a backport or can upgrade to a supported Android version. |
| Unknown version or patch date | Protection cannot be determined from the information available. | Find the Android version and Android security patch level in Settings before drawing a conclusion. |
Why are there two November dates? Google’s bulletin has separate 2026-11-01 and 2026-11-05 patch-level sections. CVE-2026-58882 is specifically listed in the 2026-11-01 section. Google says devices with the 2026-11-05 level or later address all issues in that month’s bulletin. For this one vulnerability, do not incorrectly tell readers that 2026-11-05 is the only qualifying date.
Does this affect every Pixel, Samsung Galaxy and Android phone?
No single Android-version label proves that every branded phone is already patched. Google’s bulletin describes fixes in AOSP; manufacturers must incorporate and distribute updates for their specific devices. Google says Android update schedules vary by device, manufacturer and mobile carrier. (Google Android Help.)
Samsung Galaxy: Samsung’s November 2026 Security Maintenance Release explicitly lists CVE-2026-58882 among the Google patches included in its November package. Samsung also warns that delivery timing varies by model and region. That confirms the CVE is included in the Samsung November release; it does not mean every Galaxy model received it on the same day. (Samsung Mobile Security.)
Google Pixel: Use the update screen on your own phone and verify its security patch date. A general AOSP bulletin is not proof that a particular Pixel has already downloaded and activated its over-the-air update. Google says downloaded Pixel updates become active after a restart. (Pixel Help.)
Other brands: Xiaomi, Motorola, OnePlus, Oppo, Vivo and other manufacturers may use their own update names, schedules and regional firmware branches. Check the vendor’s security bulletin or support page for your exact model and region rather than relying only on a generic Android version list.
How to check your Android security patch and install the update
Google Pixel and most Android phones
- Open Settings.
- Tap About phone (or About tablet), then open Android version.
- Find Android security update or Android security patch level. Note the full date, such as 2026-11-01.
- Return to Settings and open System → Software updates (wording can vary). Check for an available update and follow the installation prompts.
- Restart the phone when requested, then check the patch date again.
These steps follow Google’s help instructions. Google recommends using Wi-Fi and having sufficient battery charge before beginning a large update. (Check and update your Android version.)
Samsung Galaxy phones
- Open Settings → Security and privacy → Updates → Security update.
- Tap Check for updates and install the available package.
- To view software details, open Settings → About phone → Software information and inspect the security patch information if shown.
- Restart if the update requests it, then check the device’s security information again.
Samsung notes that menu names and update timing can vary between devices. Its official update guide has current instructions for Galaxy phones and tablets. (Samsung Galaxy update instructions.)
What if your Android phone has not received the patch?
First, check for an update again and consult the phone maker’s support page for your exact model, country and carrier. Some updates roll out in stages, so a package listed by Google or Samsung may not be available to every handset immediately.
If your device is on Android 12 or 13, Google’s November AOSP CVE entry does not list those versions among the updated branches. The researcher reported reproducing the issue on older Android builds, but a manufacturer could separately backport a fix. Ask the manufacturer to confirm whether your exact model has a CVE-2026-58882 fix or can move to a supported Android version. If the phone no longer receives security updates, replacing it with a supported device is the safer long-term option.
If a phone is already stuck in repeated telephony crashes or a reboot loop, contact the manufacturer or an authorised repair provider. Do not run unverified ADB commands or factory-reset the phone just because a social post recommends it; a reset can erase local data and may not be necessary. Ask support about data-preserving recovery options first.
Is the SMS of Death being actively used against Android users?
Advertisements
The vulnerability has a public technical disclosure and a proof-of-concept, which makes installing the available fix important. However, a published proof-of-concept is not the same as evidence of widespread attacks. ThaiCERT’s November 2 advisory said there was no confirmed evidence of exploitation in the wild at the time of its report. Google’s bulletin lists the CVE and its severity but does not identify it as an actively exploited vulnerability. (ThaiCERT advisory; Google bulletin.)
The reported impact is disruption of mobile service and calls, not silent access to personal data. Keep the context in perspective: check your patch, install the vendor update when available, and avoid forwarding alarming messages or unverified “test” tools.
Frequently asked questions
What is the Android SMS of Death bug (CVE-2026-58882)?
CVE-2026-58882 is a Critical-severity denial-of-service flaw in Android’s WAP Push handling. A malformed message can trigger an exception in the telephony framework, crashing com.android.phone and interrupting cellular service or calls. It is not described as remote code execution.
Which Android versions have a fix listed by Google?
Google’s November 2026 bulletin lists updated AOSP versions 14, 15, 16, 16 QPR2 and 17 for this CVE. That is not confirmation that every phone running those versions has already received an OEM update.
What security patch date fixes CVE-2026-58882?
The CVE is listed under Google’s 2026-11-01 patch-level section. The 2026-11-05 level or later addresses all issues in the November bulletin. Your manufacturer’s firmware still needs to include the patch.
Are Android 12 and Android 13 phones vulnerable?
Android 12 and 13 are not listed among the updated AOSP versions in Google’s November entry. The researcher reported tests on older Android versions, but owners should check whether their manufacturer issued a device-specific backport or Android upgrade. Do not assume a model is protected without confirmation.
Do I have to open or tap the text message?
No. The reported issue is zero-click because the telephony component processes the malformed WAP Push message before it appears as a normal message in the inbox.
Can CVE-2026-58882 steal my photos or passwords?
The CVE is classified as denial of service. Its documented impact is telephony crashes and service disruption, not remote access to photos, passwords or personal files.
How can I check the Android security patch level?
Open Settings → About phone → Android version and look for Android security update or Android security patch level. On Samsung Galaxy phones, menu labels may differ; use About phone → Software information or Samsung’s update guide.
Why has my phone not received the November update?
Manufacturers and carriers distribute updates in stages. Timing can depend on the phone model, country, carrier and firmware branch. Check your device’s update screen and the manufacturer’s model-specific security notices.
Does Google Messages spam protection block the SMS of Death?
Do not rely on a messaging-app filter. The reported issue is triggered in Android’s system telephony processing before the message is handled like an ordinary inbox message. Install the relevant system security patch instead.
- Google: Android Security Bulletin — November 2026 — official CVE severity, component, updated AOSP versions and patch-level sections.
- Android Open Source Project: Fix remote DoS in decodeWapPdu — the upstream code change and its crash-loop prevention description.
- Samsung Mobile Security: November 2026 SMR — Samsung’s inclusion of CVE-2026-58882 and its rollout caveat.
- Google Android Help: Check and update your Android version — official steps to read the patch date and install updates.
- Samsung: How to update your Galaxy device — model-dependent update instructions.
- BleepingComputer: Android SMS of Death technical report — reporting on the researcher disclosure, proof-of-concept and test observations.
- Researcher’s technical disclosure: SMS of Death — original vulnerability explanation. The article does not reproduce the exploit payload or provide attack instructions.
- ThaiCERT: Android SMS of Death advisory — public-safety advisory and in-the-wild exploitation caveat.
Disclaimer: Ultimate Info Guide is an independent publication and is not affiliated with Google, Android, Samsung or any device manufacturer.
