The Android "SMS of Death" Bug: What CVE-2026-58882 Does and How to Check Your Phone Is Patched
Part of: Encryption basics, without the jargonChecked against Google's Android Security Bulletin (November 2026) and reports by SmartScope (3 Nov) and Born City (3 Nov). This is general safety information, not personal security advice.
On 2 November 2026 Google published its monthly Android Security Bulletin. Among the fixes is CVE-2026-58882, rated Critical: a denial-of-service flaw that security writers have nicknamed the "SMS of Death". Google lists Android 14, 15, 16 and 17 as affected and fixed.
Short answer: Open Settings > About phone > Android version and look at Android security update. If the date is 1 November 2026 or later, this bug is fixed. If it is older, go to Settings > System > Software update (names vary by brand) and install what is waiting. Google's bulletin lists no fix for Android 13 or older.
What the bug does
According to reports on the bulletin:
- A specially malformed text message (a "WAP push" SMS, a type normally used for settings and service messages) triggers an integer overflow and an out-of-bounds read in the part of Android that handles SMS (SmartScope, 3 Nov 2026).
- The phone process (com.android.phone) crashes, which ends active calls, including emergency calls; about 20 such messages can push a phone into a restart loop (Born City, 3 Nov 2026).
- It needs no tap and no special permissions: receiving the message is enough.
What it is not: reports describe a crash (denial of service), not data theft or remote control. As of 3 November, SmartScope found no report of it being exploited, and Google reported no in-the-wild exploitation of the bulletin's flaws.
Who is affected
| Android version | Status in Google's bulletin |
|---|---|
| Android 17, 16 (incl. QPR2), 15, 14 | Affected, fixed by patch level 2026-11-01 or later |
| Android 13 and older | No fix listed |
Pixel phones usually get the update first. Samsung, Xiaomi, OnePlus and others ship it on their own schedule, often weeks later. Check your phone rather than assuming.
How to check and update (2 minutes)
- Settings > About phone (or About device) > Android version.
- Read Android security update (sometimes "Security patch level").
- 2026-11-01 or later: you are covered for this bug.
- Older: Settings > System > Software update (Samsung: Settings > Software update; Pixel: Settings > Security & privacy > System & updates). Install, then restart.
- Also check Google Play system update in the same area.
If your phone is on Android 13 or older: there is no listed fix. The risk here is calls being dropped and restarts, not stolen data, but a phone that no longer gets security updates collects many unfixed bugs over time. If it is your main phone, plan an upgrade, and keep emergency numbers reachable by another device if you depend on it.
Why your phone number is part of your attack surface
This bug is reached through one thing: your phone number. Anyone who knows it can send you an SMS. The same is true for SIM-swap fraud, spam and scam texts, and being found on apps that use your number as your identity. You cannot avoid having a number, but you can share it with fewer apps and fewer people. We wrote about this in social media without a phone number.
How Nadeemi fits in
Nadeemi is the app we build, so weigh this section accordingly. An app cannot fix a bug in Android itself: update your phone first. What Nadeemi does is not use your phone number at all: you join with an email, people find you by a @handle, and nobody in a group sees a number. There are no AI features and no ads. Chats are encrypted on your device with MLS in the beta; we label them "end-to-end encryption coming" until an independent audit is published. See what we can and can't see.
FAQ
Can someone hack my phone with this SMS bug? Reports describe a crash that ends calls and can cause restarts, not access to your data. Update anyway: crashes can be used to disrupt someone.
Does WhatsApp or Signal protect me from it? No. The bug is in Android's SMS handling, below every app. The fix is the Android update.
Should I turn off SMS? You usually cannot fully turn off SMS reception on a phone. Updating is the fix.
My phone says 2026-10-01. Am I at risk? Yes, if it runs Android 14 to 17. Install the November update when your phone maker releases it.
Sources (checked 6 November 2026)
- Google, Android Security Bulletin, November 2026 (published 2 Nov 2026): https://source.android.com/docs/security/bulletin/2026/2026-11-01
- SmartScope, Android SMS handling remote denial of service CVE-2026-58882 (3 Nov 2026): https://smartscope.blog/en/blog/android-sms-of-death-cve-2026-58882-remote-dos-patch-level-2026-11-01-update-2026/
- Born City, Android bulletin: 216 vulnerabilities, 23 critical (3 Nov 2026, German): https://borncity.com/news/android-bulletin-216-sicherheitsluecken-darunter-23-kritische-fehler/
- Nadeemi, what we can and can't see: https://nadeemi.com/what-we-can-see/
Names of other apps are trademarks of their owners, used only for comparison. Nadeemi is not affiliated with any of them.
Drafted with AI help and checked by a person on the date above.