A Silent Text Message Can Crash an Android Phone's Calling Software and Drop Emergency Calls. The Fix Is the October Update, and Android 12 and 13 Do Not Get It.
Check your Android phone's security update level today. A researcher published a working exploit for CVE-2026-58882, a flaw that lets anyone who can send a text message to your number crash the part of Android that handles calls, with no tap, no notification and no message in your inbox. It can drop calls in progress, including emergency calls, and the researcher says repeated messages can leave a phone unusable. Google's fix is in the October 2026 security update for Android 14 through 17. Phones on Android 12 and 13 run the same code and, according to the researcher, do not get the fix.
This is a denial-of-service flaw, not a way to steal data or take over the phone. The damage is losing your phone at the moment you may need it, and nothing in the reporting we read describes attacks in the wild.
How it fails
Security researcher Mark Blaszczyk disclosed the bug on October 29. A specially built WAP Push message, a kind of data text that phones process in the background, reaches Android's WapPushOverSms component. Android converts a header length without checking it. A short crafted sequence makes the result negative, a memory allocation fails with an exception nobody catches, and the phone's telephony process crashes. Calls drop, including emergency calls.
Telephony restarts after one to two seconds, but the malformed message stays in the pending queue and carriers may resend messages the phone never acknowledged, so the crash can repeat on every restart. The researcher found that about 20 messages could leave a device unusable for a long stretch. Android's rescue mechanism can eventually push the phone into recovery mode, and the write-up describes a boot loop. The message never shows in the inbox, and Android does not show the sender's number.
Which phones
- Android 12 and 13: The researcher reproduced the crash on 12 through 16. The write-up says 12 and 13 run the same code and do not receive the fix. One trade article says only that it does not state whether they do.
- Android 14 through 17: The fix is in the October 2026 security update, so a phone at the October 2026 patch level or later is protected.
- Tested devices: A Pixel 9 on April 2026 firmware and several Samsung Galaxy A-series phones, with a 100 percent reproduction rate according to the researcher.
- Bulletin timing: Sources differ on whether the fix is listed in the October or November Android bulletin. The write-up says October, and GrapheneOS is reported to expect it in November's bulletin, so check your own patch level, not the bulletin month.
Google received the report on May 5, wrote the fix on June 15 and rated the flaw Critical, according to the reporting. Google's fix catches runtime errors and removes malformed messages from the queue, instead of the researcher's proposal to validate the length.
What to do
- Check your patch level. Open Settings, then About phone, then Android version, and read the Android security update date. It should be October 2026 or later. Install any pending update.
- If you are on Android 12 or 13, the researcher says no fix is coming. Plan to replace the phone, and do not rely on it as your only way to reach emergency services.
- Keep a second route to emergency calls. A landline or a second phone on another carrier is our suggestion, not Google's, for anyone who depends on a phone for safety or on-call work.
- If a phone is stuck in a reboot loop, do not pick "wipe data" at the recovery prompt, since the write-up says there is a way to avoid it. A technician can use the Android Debug Bridge on a computer to remove the queued messages without wiping the phone. The last-resort fix clears the telephony provider, which erases all text messages and mobile network settings. Ask your carrier or a repair shop.
- Managing a fleet? Pull the security patch level for every Android device and list the ones on Android 12 or 13 or below October 2026. Those are the exposed ones. This is our suggestion.
What we do about it, and what we cannot
We are not a news site, so here is where we stand, as of this writing.
- There is nothing to block. The attack is a text message, not attacker infrastructure, so there is no IP address, domain or file hash for our feed to carry. The reporting names no carrier-side filter, and we do not know whether carriers can block these messages.
- Our edge cannot see it. SMS never touches the web traffic our edge shield protects. Your protection is the update.
- We checked our own corpus. Our KEV index has no entry for CVE-2026-58882, and our indicator index returned nothing for it. If exploitation is reported with attacker infrastructure, we ingest it the same day and add a dated update here.
- We are not linking the exploit. The researcher published proof-of-concept code. We read the write-up and did not run anything, and we are not linking it.
Free API keys for our blocklist feed are open to anyone, but for this one the update is the only protection there is.
Limits
The details come from the researcher's write-up and a trade-press article, plus search summaries of two others. We did not read Google's bulletin, and we could not open one outlet's article. We did not run the exploit, and we have not tested any phone. The write-up's claim about Android 12 and 13 is the researcher's, not Google's.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.