A researcher has published proof-of-concept code for CVE-2026-58882, an Android flaw that lets a specially crafted WAP Push message crash the phone process, drop calls, including emergency calls, and cut the network connection, BleepingComputer reports. The message is processed before it reaches the inbox, so the user sees nothing. With repeated messages some devices got stuck in reboot loops. Google fixed it in the October updates for Android 14 to 17, while Android 12 and 13 remain exposed.

What it means: This is a denial-of-service attack rather than data theft, but the impact is practical and immediate. A phone that loses signal or keeps rebooting cannot receive bank confirmation codes, take customer calls or dial 112. Now that the code is public, the attack needs little skill. The biggest problem lies with older devices on Android 12 and 13, which will not get a fix and remain widespread, including in businesses, for example in point-of-sale terminals, courier devices and warehouse phones. For Greek companies with mobile fleets, taking stock of versions and installing the October update is the first step, with replacement of devices that are no longer supported. Mobile operators can filter such messages in the network, something corporate customers can ask for. The episode is also a reminder that the length of software support should be a buying criterion for company phones and terminals, not just the device price.

Read the original on BleepingComputer

Related service: Custom software

Related stories