Google’s November Android Security Bulletin rates CVE-2026-58882 Critical for a remote denial of service that needs no taps and no inbox trail. The bug is not remote code execution—but a silent call-killer that can stick in the SMS queue, while Google’s AOSP fix stops at Android 14–17 and OEM timelines decide who is actually safe.
On November 2, 2026, Google published its November 2026 Android Security Bulletin. Buried in the System section under the 2026-11-01 security patch level is CVE-2026-58882 (Android bug A-517376969): a Critical denial-of-service flaw. Denial of service, or DoS, means the attack aims to disrupt a device or service rather than take it over. Google’s table marks the type as DoS, the severity Critical, and the updated Android Open Source Project versions as 14, 15, 16, 16-qpr2, and 17.
Independent researcher Mark Blaszczyk—publishing under the name Mark Blah—had already disclosed the issue around October 29 after reporting it to Google on May 5. Press coverage quickly labeled it “SMS of Death.” The nickname is dramatic; the consumer risk is more specific. A specially crafted cellular message can crash the phone process that owns calling, drop active calls including emergency ones, and—according to the researcher’s testing—recur when the message is queued or redelivered. Google’s official description is narrower and more careful. Open Source Vulnerabilities (OSV) records that in decodeWapPdu of WapPushOverSms.java there is a possible out-of-bounds read due to an integer overflow that can lead to remote denial of service with no extra privileges and no user interaction.
What Google actually fixed
OSV lists the affected package as platform/frameworks/opt/telephony, with security patch level 2026-11-01 and severity Critical. Fix commits touch both WapPushOverSms.decodeWapPdu and InboundSmsHandler.processMessage. That matters because the message is handled inside Android’s telephony stack—before a normal SMS would land in the inbox for a person to see.
WAP Push is an older Wireless Application Protocol mechanism for delivering short structured payloads over cellular messaging. Android still parses some of those messages in the telephony layer. Google’s bulletin does not publish exploit recipes. It does establish three facts consumers can use: the issue is remote DoS, Critical, and addressed for devices that receive the 2026-11-01 (or later) security patch level for the listed Android versions. Devices with patch level 2026-11-05 or later address every issue in the November bulletin, including this one; 2026-11-01 covers the 2026-11-01 set, which includes CVE-2026-58882.
Google also states that Android partners were notified of issues at least a month before bulletin publication. That partner lead time is why formal public listing can lag the first private builds—and why consumers should not treat a month name on a marketing update as proof that a specific CVE is present.
How the crash works, without the recipe
At a high level, the failure chain is an input-validation gap, not a clever remote shell. A malformed WAP Push data SMS reaches telephony processing. An unchecked conversion of a header-length field can produce a negative size. Memory allocation then fails in a way that crashes com.android.phone, the system process that manages cellular call state. Because that process owns active calls, the crash can disconnect them—including emergency calls—without the message necessarily appearing in the inbox.
That is the mechanism Google’s OSV summary supports: integer overflow / out-of-bounds read in WAP Push decoding leading to remote DoS. Researcher write-ups add more color about queueing and redelivery. Those behavioral claims should be attributed as researcher-reported until independently reproduced in public technical literature. What is not in dispute in Google’s materials is the Critical DoS rating, the zero-interaction remote reach, and the component location in telephony.
Equally important: this is not remote code execution. Critical on Android’s severity scale here means a severe availability hit—call and connectivity disruption—not that an attacker gains arbitrary code execution from the same bug alone. Confusing DoS Critical with RCE Critical makes patch urgency feel either overblown or underblown. The urgency is real because phones are call devices first; the impact class is still denial of service.
Why Critical DoS still matters for consumers
Most consumers will never be targeted. That is the wrong comfort test. A zero-click cellular message that can kill an in-progress call is a different risk profile from a phishing link that needs a tap. Emergency calling, roadside assistance, and ordinary voice calls all ride the same phone process. A crash that drops those calls is a consumer-facing security failure even when it does not steal data or install malware.
The researcher has said that queued or redelivered copies of a malicious message can cause recurring crashes, and in some testing scenarios reboot loops that were hard to clear without advanced recovery steps. Treat the severity of those persistence claims as researcher-reported. The structural point survives even if individual test anecdotes vary: once a bad message sits where telephony will keep retrying it, a one-shot DoS can become a sticky availability problem.
Public proof-of-concept discussion followed disclosure. That does not turn every phone into an imminent victim overnight. It does change the defense calculus. After a PoC exists, the remaining risk is less “can anyone invent this?” and more “who still lacks the patch, and for how long?”
October builds versus the November bulletin
Blaszczyk said Google’s fix shipped in October builds. Google formally listed CVE-2026-58882 in the November bulletin under the 2026-11-01 security patch level. Both statements can be true without meaning the same thing for users.
Security patch level is the consumer-readable date string Android shows in Settings—the contract for which bulletin issues a device claims to have absorbed. An OEM can ship October-dated builds that include some telephony changes and still not advertise 2026-11-01. Conversely, a device that shows 2026-11-01 or later for the relevant train should include the 2026-11-01 issues Google assigned to that level, including this CVE.
GrapheneOS’s project commentary on its public issue tracker is consistent with an earlier AOSP commit trail: a fix landed in mid-2026 development and appeared in GrapheneOS security-preview releases before the November bulletin made the CVE famous. That is useful context for privacy-focused builds. It is not a substitute for checking the patch level on a stock OEM phone.
Practical rule for readers: do not infer protection from the word “October” alone. Use the security patch level—2026-11-01 or later for this issue’s Google bar—and confirm an update actually installed and completed any required reboot.
Who is left out
Google’s updated AOSP list for CVE-2026-58882 is Android 14, 15, 16, 16-qpr2, and 17. Android 12 and 13 do not appear on that list. That is not a subtle omission. It means Google’s published fix set for this CVE does not cover those older major versions. Anyone still on 12 or 13 should assume no Google fix for this specific issue unless their OEM publishes an explicit, verifiable backport—something that should be confirmed from the manufacturer, not inferred from blog posts.
Even on supported versions, Android’s real-world security posture is a pipeline, not a single switch. Google publishes the bulletin and AOSP patches; OEMs integrate them; carriers sometimes gate rollout; devices age out of update promises while still placing calls. Fragmentation is not a new story. A silent, zero-click call DoS with a public PoC simply makes the cost of lag concrete.
Millions of phones will remain on older majors or on supported majors waiting for OEM images. That population is the consumer story. The CVE’s Critical label describes technical severity on a patched reference platform. Exposure after disclosure tracks update reach.
What to do—and what remains uncertain
Defensive steps are straightforward:
- Check Settings for Android version and security patch level. For Google’s bar on this issue, look for 2026-11-01 or later (2026-11-05 covers the full November bulletin).
- Install the latest system update your manufacturer offers, then reboot if prompted.
- On Android 10 and later, also check Google Play system updates, which deliver some modular fixes—though this particular CVE is a telephony / System issue tied to the bulletin’s 2026-11-01 set, not a substitute for the OEM security patch level.
- If you are on Android 12 or 13, understand that Google’s listed AOSP updates for CVE-2026-58882 do not include those versions; plan around OEM silence rather than assuming a future Google drop.
What remains uncertain should stay labeled as such. Public reporting has not produced a transparent, vendor-by-vendor matrix of which commercial builds first contained the fix. Researcher claims about reboot-loop persistence are testing anecdotes, not Google’s bulletin text. There is also no public evidence in Google’s materials that this bug alone yields remote code execution. Analysis that collapses DoS into “phone takeover” overstates the CVE; analysis that shrugs because it is “only DoS” understates call reliability as a security property.
The implication
CVE-2026-58882 is a Critical remote denial of service in Android telephony: a malformed WAP Push path that can crash com.android.phone without user interaction. Google’s November bulletin and OSV entry make the official bar clear—patch level 2026-11-01 or later on Android 14 through 17. The consumer lesson is older than this CVE. When a zero-click call-killer is public and the AOSP fix window excludes older majors, the remaining risk is the industry’s update lag, not a missing marketing adjective on the severity score. Check the patch level. Treat October branding as incomplete proof. And remember that for phones, availability of calling is part of security—not a lesser category after confidentiality and integrity.