Details have been revealed and published an exploit for a vulnerability (CVE-2026-58882) in the Android platform that allows you to achieve a loopy reboot by sending a specially designed SMS message. To eliminate the reboot loop, a factory reset or manual manipulation using the ADB utility is required. The vulnerability was codenamed “SMS of Death” and fixed in October update Android. The attack can be carried out on any phones equipped with Android 12-17. The update is released only for Android 14-17. The exploiting SMS message is processed as a background message and is not displayed on the device.
The issue is caused by an integer overflow when processing an incorrect WAP Push message header sent via SMS.
Overflow occurs because the header size field is reduced to
a signed integer of type int without proper bounds checking, resulting in a negative number in the headerLength variable. This variable is subsequently used when allocating memory through the “new byte[headerLength]” call, which, if a negative number is received, results in an exception being thrown and the com.android.phone process crashing.
After a few seconds, the process is restarted, but the effect is not limited to a short-term interruption of communication. The problematic WAP Push message, due to an abnormal termination, continues to be in the queue of unprocessed messages and a new attempt to process it leads to another abnormal termination of the com.android.phone process.
After a series of similar crashes, the RescueParty handler is triggered, which reboots the device into Recovery mode, in which it is proposed to reset to factory settings. A simple reboot does not help – if the problematic message is not removed from the queue, after about 90 seconds the device will reboot again.
To remove a message from the queue without resetting to factory settings it is suggested to use the adb utility:
adb shell content query –uri content://sms/raw –projection _id:destination_port:date:deleted adb shell cmd appops set com.android.shell WRITE_SMS allow adb shell “content delete –uri content://sms/raw –where “address=””” adb shell cmd appops set com.android.shell WRITE_SMS default adb shell pm clear com.android.providers.telephony
But this will only give the opportunity remove the SIM card, boot and install the firmware update. Since, due to the abnormal termination of the “com.android.phone” process, confirmation of processing of the WAP Push message is not sent to the telecom operator, it will make new sending attempts before the timeout expires and the situation will repeat. In the tests carried out, repeated sendings lasted from a day to a week. For devices whose manufacturers have stopped publishing firmware updates, there is no workaround for blocking the problem yet.