Android flaw can disrupt calls; patch availability varies

Technology · First reported 30 Oct, 10:33 · Updated 10:51

Image: Wikimedia Commons · NASA Johnson Space Center · Public domain

A specially crafted WAP Push message can crash Android’s telephony service, disconnect calls and, after repeated delivery, potentially leave a phone in a reboot loop. Google developed a fix, but the reports differ on which Android versions have received it and when users will get updates.

The flaw, tracked as CVE-2026-58882, can be triggered remotely by a malformed message that does not appear in the regular SMS inbox; it can crash the service responsible for cellular calls.
Repeated delivery can cause further crashes; the reports say about 20 messages were enough in testing to make a phone practically unusable or enter a reboot loop.
Google developed a fix, but the reports give differing accounts of its distribution across Android versions; both advise installing the latest available security update.

Summary written by Lux AI from 2 articles

Key facts

Vulnerability: CVE-2026-58882; described as a denial-of-service flaw.
Researcher: Mark Blaszczyk notified Google on May 5, according to Android Authority; Digital Trends reports notification in May.
Public demonstration: Blaszczyk published findings and a working demonstration on October 29.
Tested devices: The attack was reproduced on Google Pixel and Samsung Galaxy devices.
Repeated messages: About 20 messages triggered severe device problems in testing, according to both reports.