Details have emerged and an exploit has been published for the vulnerability (CVE-2026-58882) in the Android platform, allowing for a looped reboot through the sending of a specially crafted SMS message. To resolve the looped reboot, a factory reset or manual manipulation using the ADB utility is required. The vulnerability has been dubbed 'SMS of Death' and was patched in the October Android update. The attack can be performed on any phones running Android 12-17. The update has only been released for Android 14-17. The SMS message exploiting the vulnerability is processed in the background and does not appear on the device.
The issue is caused by an integer overflow when processing an invalid WAP Push message header sent via SMS.
The overflow occurs because the header size field is cast to
a signed integer of type int without proper boundary checks, allowing for a negative number to be obtained in the headerLength variable. This variable is then used when allocating memory via the call 'new byte[headerLength]', which, if a negative number is received, results in an exception being thrown and the com.android.phone process crashing.
After a few seconds, the process restarts, but the effect is not limited to a brief interruption in connectivity. The problematic WAP Push message remains in the queue of unprocessed messages due to the crash, and a new attempt to process it leads to another crash of the com.android.phone process.
After a series of similar crashes, the RescueParty handler is triggered, which reboots the device into Recovery mode, where it is suggested to perform a factory reset. A simple reboot does not help—if the problematic message is not removed from the queue, the device will reboot again in about 90 seconds.
To remove the message from the queue without performing a factory reset, it is suggested to use the adb utility:
adb shell content query —uri content://sms/raw —projection _id:destination_port:date:deleted
adb shell cmd appops set com.android.shell WRITE_SMS allow
adb shell 'content delete —uri content://sms/raw —where "address=''"'
adb shell cmd appops set com.android.shell WRITE_SMS default
adb shell pm clear com.android.providers.telephony
But this will only allow the extraction of the SIM card, booting up, and installing a firmware update. Because due to the abrupt termination of the 'com.android.phone' process, no confirmation of the WAP Push message processing is sent to the carrier, it will keep attempting to resend until the timeout expires, leading to a repeat of the situation. In the conducted tests, the repeated sends lasted from one day to a week. For devices whose manufacturers have stopped publishing firmware updates, there is currently no workaround to block this issue.
Source: opennet.ru
