CVE-2026-58882: Android SMS of Death Vulnerability — Detection and Remediation Guide

---
title: Android Telephony Crash Indicator - CVE-2026-58882
id: 8f2b4c91-6d3e-4a7b-b1c9-2e5f8a0d3c6b
status: experimental
description: Detects Android telephony service crash events that may indicate exploitation of CVE-2026-58882 (SMS of Death) via malformed SMS PDU processing.
references:
  - https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/
  - https://source.android.com/docs/security/bulletin/2026-04-01
author: Security Arsenal
date: 2026/05/28
tags:
  - attack.impact
  - attack.t1498
logsource:
  category: application
  product: android
detection:
  selection:
    EventType:
      - 'crash'
      - 'ANR'
      - 'force_close'
    ProcessName|contains:
      - 'com.android.phone'
      - 'com.android.messaging'
      - 'com.google.android.apps.messaging'
      - 'telephony'
      - 'ims'
      - 'ril'
    CrashType|contains:
      - 'native_crash'
      - 'SIGSEGV'
      - 'SIGABRT'
      - 'NullPointerException'
      - 'ArrayIndexOutOfBoundsException'
      - 'IllegalArgumentException'
  condition: selection
falsepositives:
  - Legitimate app crashes from software bugs or OS instability
  - Telephony crashes from carrier network issues
level: high
---
title: Multiple Android Device Reboots in Short Window - Potential SMS of Death Campaign
id: 3c7a1e58-9f2d-4b6a-a8e1-5d0c3f7b2a9e
status: experimental
description: Detects patterns of multiple Android devices rebooting within a short time window, potentially indicating a coordinated SMS of Death (CVE-2026-58882) attack campaign against an organization.
references:
  - https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/
author: Security Arsenal
date: 2026/05/28
tags:
  - attack.impact
  - attack.t1498
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: 'device_reboot'
    RebootReason|contains:
      - 'crash'
      - 'unexpected'
      - 'kernel_panic'
      - 'watchdog'
      - 'telephony_crash'
  condition: selection
falsepositives:
  - Normal user-initiated reboots
  - OS update-triggered reboots
  - Hardware failure
level: medium
---
title: Android SMS Database Anomaly - Potential Malformed PDU Processing
id: 5e9d2f47-1a8c-4b3e-c7d2-8a4f6b1e9c3d
status: experimental
description: Detects anomalous entries in Android SMS content provider queries that may indicate receipt of malformed SMS messages associated with CVE-2026-58882 exploitation attempts.
references:
  - https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/
author: Security Arsenal
date: 2026/05/28
tags:
  - attack.initial_access
  - attack.t1660
logsource:
  category: application
  product: android
detection:
  selection:
    ContentProvider|contains:
      - 'content://sms'
      - 'content://mms-sms'
    AnomalyIndicator|contains:
      - 'malformed_pdu'
      - 'encoding_error'
      - 'parse_failure'
      - 'invalid_length'
      - 'buffer_overflow'
  condition: selection
falsepositives:
  - Corrupt SMS messages from carrier issues
  - Legacy encoding in international SMS
level: high

// Hunt 1: Identify Android devices with telephony-related crashes in the last 7 days
// This query looks for crash events in ingested mobile device logs that may indicate CVE-2026-58882 exploitation
let timeframe = 7d;
Syslog
| where TimeGenerated > ago(timeframe)
| where Computer contains "android" or SyslogMessage contains "android"
| where SyslogMessage has_any ("com.android.phone", "telephony", "ril", "ims")
| where SyslogMessage has_any ("crash", "SIGSEGV", "SIGABRT", "NullPointerException", "ArrayIndexOutOfBoundsException", "IllegalArgumentException", "force_close", "ANR")
| extend DeviceName = extract(@"Device: ([^,\s]+)", 1, SyslogMessage)
| extend CrashComponent = extract(@"(com\.android\.\w+|telephony|ril|ims)", 1, SyslogMessage)
| extend CrashReason = extract(@"(SIGSEGV|SIGABRT|NullPointerException|ArrayIndexOutOfBoundsException|IllegalArgumentException)", 1, SyslogMessage)
| summarize CrashCount = count(), DistinctDevices = dcount(DeviceName), LatestCrash = max(TimeGenerated)
  by CrashComponent, CrashReason
| order by CrashCount desc;

// Hunt 2: Detect clusters of Android device reboots within a 30-minute window (potential coordinated attack)
let timeframe = 24h;
Syslog
| where TimeGenerated > ago(timeframe)
| where SyslogMessage has_any ("device_reboot", "boot_completed", "unexpected_reboot", "telephony_crash")
| where SyslogMessage contains "android"
| extend DeviceName = extract(@"Device: ([^,\s]+)", 1, SyslogMessage)
| summarize RebootCount = count(), Devices = make_set(DeviceName)
  by bin(TimeGenerated, 30m)
| where RebootCount >= 3
| order by TimeGenerated desc;

// Hunt 3: Identify Android devices not yet patched to April 2026 security level
// This requires MDM/Intune device compliance data ingested into Sentinel or Defender
DeviceInfo
| where TimeGenerated > ago(1d)
| where OSPlatform == "Android"
| extend SecurityPatchLevel = tostring(parse_json(AdditionalFields).SecurityPatchLevel)
| where isempty(SecurityPatchLevel) or SecurityPatchLevel < "2026-04-05"
| summarize arg_max(TimeGenerated, *) by DeviceId
| project DeviceName, OSVersion, SecurityPatchLevel, Model, LastSeen = TimeGenerated
| order by SecurityPatchLevel asc;

-- CVE-2026-58882: Hunt for SMS of Death exploitation artifacts on Android devices
-- This artifact examines SMS database entries and crash logs for indicators of malformed PDU processing

-- Query 1: Examine recent SMS entries for malformed or anomalous records
SELECT
    date,
    address AS SenderNumber,
    body AS MessageBody,
    type AS MessageType,
    read AS ReadStatus,
    date_sent AS DateSent,
    length(body) AS BodyLength,
    CASE
        WHEN body IS NULL AND type = 1 THEN 'SUSPICIOUS_NULL_BODY'
        WHEN length(body) > 160 AND type = 1 THEN 'LONG_SMS'
        WHEN body =~ '[\x00-\x08\x0b\x0c\x0e-\x1f]' THEN 'CONTROL_CHARS_PRESENT'
        ELSE 'NORMAL'
    END AS AnalysisFlag
FROM Android.Applications.SMS()
WHERE date > (int(time=now()) - 604800) * 1000  -- Last 7 days
ORDER BY date DESC

-- Query 2: Check for telephony-related crash logs in Android dropbox
SELECT
    FullPath,
    Name,
    Size,
    Mtime AS ModifiedTime
FROM glob(globs='/data/system/dropbox/*phone*crash*')
WHERE Mtime > time() - 604800
ORDER BY ModifiedTime DESC

-- Query 3: Check for telephony crash logs in Android tombstones
SELECT
    FullPath,
    Name,
    Size,
    Mtime AS ModifiedTime
FROM glob(globs='/data/tombstones/tombstone_*')
WHERE Mtime > time() - 604800
ORDER BY ModifiedTime DESC

#!/bin/bash
# CVE-2026-58882 Android SMS of Death - Patch Level Verification Script
# Checks Android devices via ADB for April 2026+ security patch level
# Usage: ./check_sms_of_death_patch.sh [device_serial]

REQUIRED_PATCH="2026-04-05"
VULNERABLE_DEVICES=()
PATCHED_DEVICES=()
UNKNOWN_DEVICES=()

echo "=============================================="
echo "CVE-2026-58882 SMS of Death - Patch Audit"
echo "Required Patch Level: ${REQUIRED_PATCH}"
echo "=============================================="

# Function to check a single device
check_device() {
    local SERIAL="$1"
    local PATCH_LEVEL
    local DEVICE_MODEL
    local OS_VERSION

    DEVICE_MODEL=$(adb -s "$SERIAL" shell getprop ro.product.model 2>/dev/null | tr -d '\r')
    OS_VERSION=$(adb -s "$SERIAL" shell getprop ro.build.version.release 2>/dev/null | tr -d '\r')
    PATCH_LEVEL=$(adb -s "$SERIAL" shell getprop ro.build.version.security_patch 2>/dev/null | tr -d '\r')

    if [ -z "$PATCH_LEVEL" ]; then
        echo "[UNKNOWN]  $SERIAL ($DEVICE_MODEL) - Could not determine patch level"
        UNKNOWN_DEVICES+=("$SERIAL|$DEVICE_MODEL|unknown")
        return
    fi

    if [[ "$PATCH_LEVEL" < "$REQUIRED_PATCH" ]]; then
        echo "[VULNERABLE] $SERIAL ($DEVICE_MODEL, Android $OS_VERSION) - Patch: $PATCH_LEVEL"
        VULNERABLE_DEVICES+=("$SERIAL|$DEVICE_MODEL|$OS_VERSION|$PATCH_LEVEL")
    else
        echo "[PATCHED]    $SERIAL ($DEVICE_MODEL, Android $OS_VERSION) - Patch: $PATCH_LEVEL"
        PATCHED_DEVICES+=("$SERIAL|$DEVICE_MODEL|$OS_VERSION|$PATCH_LEVEL")
    fi
}

# Check specific device or all connected devices
if [ -n "$1" ]; then
    check_device "$1"
else
    echo ""
    echo "Scanning all connected devices..."
    echo ""
    DEVICES=$(adb devices | grep -v "List" | grep "device$" | awk '{print $1}')

    if [ -z "$DEVICES" ]; then
        echo "No devices connected via ADB."
        exit 1
    fi

    for DEVICE in $DEVICES; do
        check_device "$DEVICE"
    done
fi

echo ""
echo "=============================================="
echo "AUDIT SUMMARY"
echo "=============================================="
echo "Vulnerable: ${#VULNERABLE_DEVICES[@]}"
echo "Patched:    ${#PATCHED_DEVICES[@]}"
echo "Unknown:    ${#UNKNOWN_DEVICES[@]}"

if [ ${#VULNERABLE_DEVICES[@]} -gt 0 ]; then
    echo ""
    echo "--- VULNERABLE DEVICES REQUIRING IMMEDIATE PATCHING ---"
    for ENTRY in "${VULNERABLE_DEVICES[@]}"; do
        IFS='|' read -r SERIAL MODEL OSVER PATCH <<< "$ENTRY"
        echo "  Serial: $SERIAL | Model: $MODEL | Android: $OSVER | Patch: $PATCH"
    done
    echo ""
    echo "ACTION REQUIRED: Apply April 2026 Android Security Update (2026-04-05)"
    echo "Advisory: https://source.android.com/docs/security/bulletin/2026-04-01"
    exit 2
fi

echo ""
echo "All devices verified against CVE-2026-58882."
exit 0