CVE-2026-58882

Name of the Vulnerable Software and Affected Versions Android versions 12 through 17

Description An issue in the Android core telephony framework allows a remote, zero-click denial-of-service attack. An attacker can send a specially crafted 8-byte WAP Push SMS to port 2948, which is an outdated format used by networks to push settings or links. The vulnerability occurs during the processing of the WSP header, where a manipulated length value is read as a uintvar and cast to a Java int. This results in a negative value, triggering an unhandled NegativeArraySizeException in the com.android.phone process.

This crash immediately terminates the calling service, dropping all active calls, including emergency calls. Because the malicious message remains queued on the device and may be redelivered by the network, the phone can enter a persistent reboot loop, crashing approximately every 90 seconds. Approximately 20 such messages can render a device completely unusable. The attack is invisible as the messages do not appear in the user's SMS inbox.

Recommendations For Android versions 14 through 17, install the October or November 2026 security updates. For Android versions 12 and 13, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, users can move the SIM card to a non-Android phone to clear the malicious message queue or use the Android Debug Bridge (ADB) to manually delete the queued message. Restrict the use of binary SMS messages or implement carrier-level filtering of malformed WAP Push messages if possible.