«SMS of Death»: an invisible text message can knock your Android off calls, even emergency ones

On 29 October 2026 an Android flaw went public with a name that sounds like an urban legend, «SMS of Death», and that Google rates as critical. The idea is simple, which is what makes it unsettling: a text message you never see arrive can knock out the part of the phone that handles calls. It drops the call you have in progress, including a call to emergency services, and if several arrive, the phone ends up rebooting over and over.

It is not a virus you install or a link you fall for. You do not have to touch anything: the message never appears in your inbox and shows no sender number. This is not a guide to picking the flaw apart; it is what you need to know as a person who uses a phone: who is affected, how to check whether yours is protected and what to do if it is not.

Also on YouTube as a Short (54 s).

What was reported

On 29 October a security researcher disclosed the flaw, with the identifier CVE-2026-58882, and Google flagged it as critical. These are the facts from the report, each confirmed by at least two sources (see Sources):

• It affects Android from version 12 to 17. It was reproduced on a Pixel 9 and on Samsung Galaxy devices.
• The message is a technical kind of SMS, not the sort used to chat. It never appears in your inbox and shows no sender.
• It briefly knocks out the system component that handles telephony. The effect for whoever receives it: calls in progress drop, including emergency calls.
• With around 20 messages, the phone becomes practically unusable, in a reboot cycle roughly every minute and a half.
• It was reported to Google on 5 May 2026 and fixed in the October 2026 security update for Android 14 to 17.

No data theft or leak is described: the damage is leaving you without service. In Google’s own category, it is a remote denial of service.

En llamadaSin servicio

Mensajes que llegan sin verse

Reiniciando…

Who is left unpatched

Here is the detail that decides whether it reaches you. The fix landed in the October patch, but only for the versions Google still maintains. Android 12 and 13 fell out of that window, so they are not getting an official patch; it would depend on the phone’s manufacturer shipping one on its own, which rarely happens on devices that old.

And there is a catch beyond the version: being on Android 14 to 17 is not enough if you did not apply the October security update. I checked it on a phone I had at hand, a POCO running Android 16. Its patch level read «1 September 2026»: a version that does receive the fix, but with the patch still a month behind the one that carries it. In other words, within the range Google fixes and still unfixed.

Acerca del teléfono

Versión de Android16

Nivel de parche de seguridad de Android1 de septiembre de 2026

ModeloPOCO 25102PCBEG

Todavía expuesto

versión que recibe el arreglo, pero con el parche anterior a octubre de 2026.

How to check your patch level

The figure that matters is the date of the «Android security patch level». Where to find it depends on the brand:

• Stock Android, Pixel, Motorola, Nothing: Settings → Security & privacy → Updates → Security update. Or Settings → About phone → Android version.
• Samsung (One UI): Settings → About phone → Software information → «Android security patch level».
• Xiaomi, POCO, Redmi (HyperOS/MIUI): Settings → About phone → Android version; the patch level is shown there.

Read two things: the Android version (12 to 17) and the security patch date. You are covered if the version is 14 to 17 and the date is 1 October 2026 or later. Then, on the same updates screen, tap «Check for updates» and install anything pending.

What to do if your phone no longer gets patches

If you are on Android 12 or 13, or your device stopped receiving updates, there is no button that fixes it. What makes sense:

• Check the manufacturer’s website for an out-of-cycle patch for this flaw. Some do ship one for critical flaws.
• Keep the real size of the risk in mind: the exposure is losing call service for a while, not losing your data. No data theft was described.
• If the phone starts rebooting, switching it to airplane mode or pulling the SIM stops new messages from arriving while you look for the patch or a replacement.
• If that phone is your only way to call emergency services, weigh it calmly: a device with no security support is, at this point, a decision worth revisiting beyond this one flaw.

Why it is worth a look

Almost nobody uses SMS to write to each other anymore, but it lives on underneath, in technical messages the phone processes without showing them to you. This flaw takes advantage of exactly that: something you assume is dead and is still running. The good news is that the defense asks for nothing unusual (no app, no switching messaging apps), only that the patch be applied. The uncomfortable part is that millions of phones on Android 12 and 13, and plenty more with a lagging patch, will stay exposed for a good while.

In Chile this story barely circulated in Spanish when it broke, and it affects anyone with an Android within reach. That is why this note, rather than letting it pass.

Sources

• SMS of Death · researcher’s write-up (en, primary source)
• heise online · «SMS of Death»: Security flaw crashes Android phones (en)
• Android Authority · Android «SMS of Death» and Google’s fix (en)
• Cybernews · Android «SMS of Death» critical vulnerability (en)
• eSecurity Planet · Android «SMS of Death», CVE-2026-58882 (en)
• Androidsis · «SMS of Death»: an invisible message can knock out Android calls (es)

Frequently asked questions

What is the «SMS of Death»?

It is the nickname given on 29 October 2026 to an Android security flaw (CVE-2026-58882) that Google rates as critical. A text message of a technical kind, not the sort used for chatting, temporarily knocks out the part of the phone that handles calls. It needs no action from you: it never appears in your inbox and shows no sender number.

Which phones are affected?

According to the report, Android phones from version 12 to 17, reproduced on a Pixel 9 and on Samsung Galaxy devices. Google fixed the flaw in the October 2026 security update for Android 14 to 17. Versions 12 and 13 no longer receive updates from Google, so they will likely stay unpatched unless the manufacturer ships a patch of its own.

Am I affected if my phone is up to date?

If your phone is Android 14, 15, 16 or 17 and its security patch level is October 2026 or later, it already has the fix. That is the point: the Android version alone is not enough, the October security update has to be applied too. How to check it is below.

How do I check my security patch level?

On stock Android or a Pixel: Settings → Security & privacy → Updates → Security update (or Settings → About phone → Android version). You will see «Android security update» with a date. On Samsung: Settings → About phone → Software information. If the date is 1 October 2026 or later and your version is 14 to 17, you are covered. Check for updates and apply any that are pending.

What if my phone no longer gets updates?

If you are on Android 12 or 13, or a device the manufacturer no longer updates, check its website for an out-of-cycle patch. In the meantime, the exposure is losing call service for a while, not losing your data: no data theft is described. If the phone starts rebooting, pulling the SIM or switching to airplane mode stops new messages from arriving while you sort out a replacement or find the manufacturer's patch.

Do I need to delete any message or change my SMS app?

No. The message that triggers the flaw never reaches your inbox and you never see it, so there is nothing to delete by hand, and the app you read your messages with changes nothing. The only thing that protects you is having the October 2026 security update applied on an Android version that receives it.

Written on 31 October 2026. The patch level was checked on a POCO (model 25102PCBEG) running Android 16, security patch level 1 September 2026 (getprop ro.build.version.security_patch). The affected versions, the message count, the reboot interval and the report and patch dates come from the researcher’s write-up and the cited sources, not from a test of my own: I did not reproduce the flaw.