Security researcher Mark Blaszczyk has discovered a zero click vulnerability affecting older Android smartphones via incoming text messages. The flaw triggers cellular crashes and endless reboot loops simply upon receiving malicious WAP Push messages without any user interaction. Google patched the issue for Android 14 through 17, but devices running Android 12 and 13 currently remain exposed.
The security flaw carries the tracking code CVE 2026 58882 and stems from incorrect data processing inside Android telephony components. Incoming WAP Push messages force the core communication service to crash instantly. This crash disconnects the phone from cell towers, drops active voice calls, and blocks emergency dialing. Because this is a zero click attack, the victim never needs to open, read, or interact with the incoming message for the failure to occur.
Attackers can escalate the disruption by sending multiple messages in rapid succession. Controlled tests showed that sending 20 malicious texts caused hardware to enter persistent reboot cycles. An Android 12 test unit entered recovery mode every 90 seconds, leaving the device unusable until the tester performed a complete factory reset to wipe the system partition.
Google addressed the vulnerability across modern software releases spanning Android 14, Android 15, Android 16, and Android 17. The company omitted any public description of the issue in its standard monthly security documentation. Devices running Android 12 and Android 13 have not received a patch for this flaw, leaving millions of older phones vulnerable to remote disconnection unless users upgrade to a newer operating system or apply the latest carrier updates.
