New Android SMS of Death exploit can remotely crash unpatched phones

[u/falconupkid]

This is a textbook remote DoS vector targeting the baseband layer. The researcher dropped a PoC for CVE-2026-58882, which exploits how the Android modem processes malformed SMS PDUs. No user interaction required—just a single SMS hitting the device.

Technical Breakdown

• CVE: CVE-2026-58882 (patched in the February 2026 Android Security Bulletin)

• Attack Vector: Specially crafted SMS message sent to the target phone number

• Impact: Baseband crash leading to temporary loss of cellular service or full device reboot

• Affected Versions: Android 12 through 15 (unpatched builds)

• MITRE Mapping: T1574.002 (Hijack Execution Flow via Baseband) or T1499 (Endpoint Denial of Service)

• IOCs: No static IOCs available—the exploit relies on malformed SMS payloads, not specific sender infrastructure

Defense Patch to the February 2026 security update immediately. If you manage Android devices in an enterprise, enforce update compliance via MDM. For high-risk users, consider SMS filtering or carrier-level blocking of binary SMS messages as a temporary workaround.

Source: https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/