Eight bytes in a text message you'll never see can knock an Android phone off the network

The message never reaches your inbox. It's a WAP Push, the kind of silent text carriers use for settings, and it's eight bytes long. The researcher who found it, Mark B, published the full write-up at smsofdeath.com on 29 October and then put a working proof-of-concept app on GitHub. BleepingComputer picked it up on Friday. The flaw is tracked as CVE-2026-58882 and it needs nothing from you. No tap, no link, no preview.

What happens is a maths error. Android reads a length value from the message, converts it to a number type that can't hold it, and tries to reserve a negative amount of memory. The phone process crashes. For a second or two there's no mobile service, and any call in progress drops, including a call to emergency services. On its own that's a nuisance. The trouble is that the network never gets an acknowledgement, so the carrier resends, and the stored message is re-read every time the process restarts. Send twenty of them, the researcher says, and the phone falls into a reboot loop. One Android 12 test device restarted into recovery mode every 90 seconds until it was factory reset.

Google received the report on 5 May, wrote a fix in June, and shipped it in the October 2026 security update for Android 14 through 17, though it isn't listed in October's bulletin. Android 12 and 13 are outside the fix window and stay vulnerable. So the question for you is a single line in Settings, under Security or About phone: the Android security update date. October 2026 or later and you're covered. If it's older, check for updates and restart. If your phone can't go past Android 13, this is one more reason to think about replacing it. And should a phone ever get stuck restarting after a burst of this, don't pick the wipe option at the recovery screen. A technician can remove the messages with a cable and a PC.

Tendvane only looks after the Windows side, but its check-for-updates does for your PC what that one line in Settings does for your phone: tells you whether the fixes already exist and simply haven't landed yet.