A malformed data text can crash Android’s phone service without appearing in the inbox, Lawrence Abrams reports. Researcher Mark B demonstrated interrupted calls and repeated crashes, including a reboot loop on an Android 12 device. Emergency calls can also be interrupted.

Evidence status: researcher demonstration. The reporting describes a published proof of concept, not confirmed attacks against the public. BleepingComputer associates the flaw with CVE-2026-58882, but the identifier is not listed in Google’s October bulletin, so that mapping remains unverified.

What breaks

The researcher’s account says a specially formed WAP Push message reaches Android’s telephony software before the user sees it. An unchecked length can cause the phone process to crash. Retried messages can cause repeated interruptions, and the researcher reports a persistent reboot loop on a test device.

Google’s telephony change describes handling the decoding exception and deleting the problematic queued message to prevent crash loops. The change itself does not establish which manufacturers have deployed it to individual devices.

What to do

  • Install the latest security update offered by your phone maker and restart if prompted. Check the Android security patch level in Settings and consult the manufacturer’s support information.
  • The researcher says the fix was released for Android 14 through 17 in October 2026. Android 12 and 13 are outside that stated update window. Device and carrier rollout can differ; ask the manufacturer whether your specific model has the fix.
  • If a phone is repeatedly rebooting, contact the manufacturer or carrier for recovery assistance. The researcher describes an advanced computer-assisted recovery method, but it may not be available on every device. A factory reset can erase local data.
  • If calls are unreliable during an emergency, use another working phone or another available way to contact emergency services.

Caveat: Google’s published October security bulletin does not identify this specific flaw, so its patch-level claims should not be treated as independent confirmation for every device.