A security researcher has made public a way to knock out an Android phone’s calling service with nothing more than a text message. The messages never show up in the inbox, yet they can drop calls, including emergency ones, and repeated attempts can leave a phone stuck rebooting.
Google says a fix exists. The open question is how many phones have received it yet, since the vulnerable code goes back to Android 12.
How the attack works
Researcher Mark Blaszczyk found that a specially crafted SMS makes the part of Android that handles calls fail while it tries to process the message. The phone does not discard it, so the same crash can repeat. Blaszczyk says about 20 such messages are enough to make a phone close to unusable and push it into a boot loop.
Recovery is awkward. If the carrier keeps resending the messages, even a factory reset may not help, and clearing them otherwise means connecting the phone to a computer. Blaszczyk reproduced the attack on Google Pixel and Samsung Galaxy phones. Android Authority reported that older versions that no longer get security updates may stay exposed.
Google’s patch timeline
Blaszczyk says he reported the problem to Google on 5 May and that Google treated it as a non-security issue, so he published the details and a working demo on 29 October. Android’s own code history shows a fix dated 15 June, which makes the message crash handled and removes the offending message instead of retrying it. GrapheneOS said on X that Google shipped the fix in security previews in July.
The flaw is tracked as CVE-2026-58882 with a Critical rating, and is expected in the November Android Security Bulletin. Blaszczyk says the fix was already in October’s updates for Android 14 to 17. Google has not explained why its response to the report and its own fix did not line up, and the publication says it has asked Google about the patch timeline.
Until Google or a phone maker confirms the fix for a given model, the practical advice is to install the newest security update available and check the Android security patch level under Settings.
The November Android Security Bulletin should confirm which Android versions carry the fix.
