8-byte WAP Push SMS can crash Android's phone process and drop live and emergency calls

A researcher has published a working exploit for CVE-2026-58882, an Android flaw that lets a single malformed text message crash the system component responsible for phone calls. According to a post on dev.to, researcher Mark Blaszczyk showed that an eight-byte WAP Push message sent to port 2948 is enough to bring down com.android.phone, Android's telephony process. When that process dies, any call in progress is disconnected, including calls to emergency services.

The attack requires no interaction from the recipient, who never sees the message arrive.

How the crash works

WAP Push is a legacy SMS-based delivery format that Android processes silently in the background rather than displaying as a regular text. Per the dev.to write-up, that invisibility is what makes the exploit practical: the malformed eight-byte payload is handled automatically, and processing it crashes com.android.phone.

One message ends the current call session, but the damage scales with repetition. According to dev.to, around twenty of the messages can push a handset into a reboot loop, rendering it effectively unusable.

The fix covers only recent Android versions

The underlying bug has been present since Android 12, the dev.to post reports. Google shipped a fix in the October security updates, but the patch applies only to Android versions 14 through 17. Devices still running Android 12 or 13 received nothing, leaving them without a vendor fix for a flaw that can now be reproduced from a public write-up.

Serious, but availability only

The source scopes the damage narrowly. No attacks exploiting the vulnerability have been confirmed in the wild so far, and the impact is a loss of availability rather than data theft: the flaw crashes a process and disrupts service, but there is no indication it exposes the device's contents.

What users can actually do

Defenses are thin. According to dev.to, Android exposes no setting that blocks incoming WAP Push messages, so the only practical protection is installing the latest security update, meaning the October patch level for anyone on Android 14 or newer. For devices stuck on Android 12 or 13, the post offers no workaround at all.

Why it matters

This bug is a reminder that availability can matter as much as confidentiality. A call that silently drops is more than an annoyance when the call is to emergency services, and an attack that needs nothing beyond a phone number and an invisible message removes almost every barrier to carrying it out.

The patch gap is the more troubling part. Devices on Android 12 and 13 have no fix and no way to filter the malicious messages themselves, so the population of exposed phones will shrink only as people move off aging hardware. With a working exploit now public, the margin between disclosure and abuse depends on how quickly users update, and on whether anyone decides to weaponise a text message its victims never see.