Critical Android “SMS of Death” Vulnerability (CVE‑2026‑58882) Enables Remote Call Disruption
What Happened — Google’s November 2026 Android security update patches CVE‑2026‑58882, a critical denial‑of‑service flaw in the platform’s handling of WAP‑Push (data‑SMS) messages. An attacker can send a specially crafted WAP‑Push packet that triggers an integer overflow in decodeWapPdu, crashing the com.android.phone process. The crash occurs before the message reaches the user‑visible messaging app, so the victim does not need to open the text. The result is an abrupt termination of any active cellular call, including emergency calls. Google released the fix in security patch level 2026‑11‑01; rollout depends on device manufacturers, models, and carriers.
Why It Matters for Trust & Control Assurance — The incident underscores the need for a documented, continuous patch‑management control that can be evidenced across mobile device fleets.
Who Is Affected — Enterprises that manage Android smartphones (e.g., BYOD programs, field‑service teams) and any end‑users running unpatched Android versions.
Recommended Actions
- Verify the security‑patch level on all Android devices; ensure they are at 2026‑11‑01 or later.
- Prioritize patch deployment for devices that cannot auto‑update (carrier‑locked or legacy models).
- Incorporate mobile‑device patch status into your continuous compliance monitoring dashboard.
- Review incident‑response playbooks to include denial‑of‑service scenarios affecting telephony.
Source: TechRepublic article
Technical Notes
- Attack vector: Vulnerability exploit via malformed WAP‑Push SMS (no user interaction).
- CVSS: Not publicly disclosed, but Google classifies it as critical.
- Root cause: Integer overflow in
WapPushOverSms.java(decodeWapPdu). - Impact: Potential loss of voice service, including emergency calls.
Source: Google Android Security Bulletin, November 2026