Android Text Message Flaw Can Crash Unpatched Phones

A newly published proof-of-concept attack can crash an unpatched Android phone or interrupt its cellular service when the device receives a specially formed text message. Because Android processes the message before showing it in the inbox, a household member may lose a call—including an emergency call—without seeing the message that caused the problem.

What happened

A security researcher released working demonstration code for an Android vulnerability identified as CVE-2026-58882, according to BleepingComputer. The attack requires no tap, reply or other action by the recipient.

The malicious message causes Android’s phone process, which manages cellular functions, to crash. That can disconnect a call already in progress and temporarily disrupt mobile connectivity. The message may never appear in the normal SMS inbox because the operating system handles it first.

The researcher also found that repeated messages could create more serious problems. In testing, 20 messages caused some phones to enter reboot loops. One Android 12 device repeatedly entered recovery mode and ultimately needed a factory reset. Repeated carrier delivery attempts or stored malicious messages could trigger additional crashes.

Google reportedly addressed the problem in its October 2026 security updates for Android 14 through Android 17. However, BleepingComputer says the vulnerability does not appear in Google’s October security bulletin. The fix catches the error that causes the crash and removes malicious messages from the SMS database.

Who is affected

The threat applies to Android phones that have not received the fix. According to the researcher cited by BleepingComputer, Android 12 and Android 13 devices remain vulnerable because they did not receive this patch.

Phones running Android 14 through Android 17 should be protected after receiving the relevant October 2026 security update. Update delivery depends on the phone manufacturer and wireless carrier, however, and a restart may be needed to finish installation.

The source does not identify specific phone brands or models, so owners should not assume a device is protected based only on its age or manufacturer. The source also does not report attacks against the public, but working proof-of-concept code is now available.

What to do now

1. Open your phone’s Settings and check the software or security update section. Install every available Android system and security update, not just app updates from the Play Store.

2. Restart the phone after updating. BleepingComputer notes that a restart may be required before an Android security update is fully installed.

3. Check the phone’s Android version and security patch information after it restarts. If it still runs Android 12 or Android 13, the researcher says it remains vulnerable to this flaw.

4. Ask the manufacturer or carrier whether your exact model will receive the October 2026 Android security fix. A complete list of affected or patched models has not been disclosed.

5. If the phone begins crashing or repeatedly rebooting after an unexplained loss of cellular service, do not keep resetting it without a backup. BleepingComputer reports that removing stored malicious messages may require Android Debug Bridge, a computer and advanced technical knowledge; professional support may be the safer option.

6. Confirm that every Android phone used by the household or small office has been checked separately. Update availability can differ by manufacturer, carrier and device.