Android November 2026 Update: Zero-Click Flaw and SMS of Death

In short: Google’s November 2026 Android bulletin fixes 216 flaws, 23 critical. The worst, CVE-2026-58868, could let an attacker run code on Android 14–17 with no user interaction. It also covers the “SMS of Death” (CVE-2026-58882), a public exploit that crashes the phone app with one 8-byte message. Check that your phone shows security update 2026-11-01 or later, ideally 2026-11-05.
Last updated: November 7, 2026

Android November 2026 security update: CVE-2026-58868 and SMS of Death

Android’s monthly security update is easy to ignore. This month it shouldn’t be: it fixes a critical bug that needs no tap from the user and a crash bug that anyone with your phone number can trigger. Here is what is fixed and how to check your phone in 30 seconds.

CVE-2026-58868: Zero-Click Code Execution

The headline fix is a heap buffer overflow in the onOutputReceived function of FrameDecoder.cpp. Google rates it critical because, in the worst case, an attacker could run code remotely without any action from you.

Affected: Android 14, 15, 16 and 17.
Fixed in: security patch level 2026-11-01.
Exploited? Google reported no attacks as of November 4.
Caveat: the critical rating assumes Android’s built-in protections are bypassed. Real-world attacks would need more work, but this is exactly the kind of bug spyware vendors look for.

The “SMS of Death” (CVE-2026-58882)

The second bug has a catchy name and a public exploit. Security researcher Mark Blah showed that a malformed 8-byte WAP Push message, sent as a data SMS to port 2948, crashes the com.android.phone process before the message ever reaches your inbox.

Ongoing calls are dropped, including emergency calls.
Mobile service is interrupted, and stored or redelivered messages can crash it again and again.
In testing, 20 messages caused reboot loops, and one Android 12 phone needed a factory reset.
The attacker only needs your phone number.

According to the researcher, Google fixed it in its October 2026 updates for Android 14 to 17. The November bulletin lists CVE-2026-58882 as a critical remote denial-of-service bug in the same decodeWapPdu code. The researcher says Android 12 and 13 run that code without the fix.

Everything Else in the Bulletin

Area	What is fixed
Total	216 vulnerabilities, 23 critical
System	CVE-2026-58876 and CVE-2026-58936, both critical remote code execution
Kernel	6 critical flaws, 2 of them in Bluetooth
Vendor parts	Critical MediaTek modem flaws and a critical flaw in a Qualcomm component

There are two patch levels. 2026-11-01 covers the Android framework and system flaws, including CVE-2026-58868. 2026-11-05 adds the kernel and chip-vendor fixes. Phone makers and carriers roll them out on their own schedules, so some phones get them weeks later.

How to Check Your Phone

Open Settings.
Tap About phone (on some phones: About tablet, or Software information).
Tap Android version.
Look at Android security update. You want 1 November 2026 or later, ideally 5 November 2026.

If it is older, go to Settings → System → Software update (or Settings → Security and privacy → Updates) and install what is available. Also update the Google Play system update on the same screen, although CVE-2026-58868 is fixed through the security update, not Google Play.

If Your Phone No Longer Gets Updates

Phones stuck on Android 12 or 13 will not get these fixes. The SMS of Death in particular affects them. If you rely on an old phone for important calls, it is worth replacing it with one that still receives monthly updates, or installing a maintained custom ROM if you know how.

Frequently Asked Questions

What is CVE-2026-58868?

A critical heap buffer overflow in Android’s FrameDecoder.cpp that Google says could let an attacker run code remotely with no action from the user. It affects Android 14 to 17 and is fixed in the 2026-11-01 security patch level.

What is the SMS of Death?

A bug tracked as CVE-2026-58882 where a malformed 8-byte WAP Push message, sent as a data SMS, crashes the phone process. It drops ongoing calls, including emergency calls, and repeated messages can cause reboot loops. A public proof of concept exists.

Is my phone protected?

Open Settings, About phone, Android version and look at the Android security update date. 2026-11-01 covers CVE-2026-58868; 2026-11-05 covers everything in the November bulletin.

Are these flaws being exploited?

Google’s bulletin reported no attacks using CVE-2026-58868 as of November 4. The SMS of Death has a public proof of concept, so attacks are easy to attempt.

My phone runs Android 12 or 13. What now?

Google’s bulletin does not list Android 12 or 13 for CVE-2026-58868, and the researcher behind the SMS of Death says those versions did not get that fix. If your phone no longer gets updates, consider replacing it or switching to a custom ROM that is still maintained.

Android November 2026 Update: Zero-Click Flaw CVE-2026-58868 and the “SMS of Death” Explained