Search — “CVE-2026-58882”

A researcher published a proof-of-concept for CVE-2026-58882, a zero-click denial-of-service flaw in Android's WapPushOverSms.decodeWapPdu that a malformed eight-byte WAP Push message sent as a data SMS to port 2948 can trigger. The crash of com.android.phone disrupts cellular connectivity and ongoing calls, and can cause reboot loops; Google reportedly patched it in the October 2026 updates for Android 14 through 17, while Android 12 and 13 remain unpatched. Hunters should look for abnormal crashes of com.android.phone and inbound data SMS to port 2948 on devices that are not yet patched.