Android's November 2026 Update Patches 216 Flaws, Including a Call-Dropping 'SMS of Death' Bug

Google published its Android Security Bulletin for November 2026 on 2 November 2026, covering two patch levels, 2026-11-01 and 2026-11-05. Between them the bulletin fixes 216 vulnerabilities — 119 at the first patch level and 97 at the second — of which more than two dozen are rated Critical, according to SecurityWeek's review of the bulletin published 3 November 2026.

What the bulletin fixes

The bulletin describes the most severe issue as "a critical security vulnerability in the Framework component that could lead to remote code execution with no additional execution privileges needed," tracked as CVE-2026-58868. Two further Critical remote-code-execution flaws, CVE-2026-58876 and CVE-2026-58936, sit in the System component, alongside Critical elevation-of-privilege bugs (CVE-2026-55275, CVE-2026-55283, CVE-2026-58984) and Critical issues in Bluetooth and pKVM kernel code (CVE-2026-53256, CVE-2026-59044, CVE-2026-59045), per the bulletin. The second patch level, 2026-11-05, adds fixes for Kernel, Arm, Imagination Technologies, MediaTek, Unisoc and Qualcomm components, Google's bulletin states. Devices are considered fully updated only once they carry the 2026-11-05 patch level or later.

Google lists updated AOSP branches for Android 14, 15, 16, 16 QPR2 and 17, meaning devices still running Android 12 or 13 are outside the bulletin's coverage entirely.

The bug nicknamed "SMS of Death"

One of the Critical denial-of-service entries in the System component, CVE-2026-58882, corresponds to a flaw that security researcher Mark Blaszczyk disclosed publicly on 29 October 2026 at smsofdeath.com, after reporting it to Google's Android and Devices VRP program on 5 May 2026. Blaszczyk's write-up describes the bug as sitting in WapPushOverSms.decodeWapPdu(), where a message's declared header length is read as a 64-bit value and cast to a 32-bit integer without a bounds check. A crafted 5-byte header value decodes to 0x80000000, which becomes a negative number once cast — and that negative number is then used as an array size, throwing a NegativeArraySizeException that crashes the phone process, com.android.phone, according to Blaszczyk's page.

Blaszczyk writes that the malformed message leaves nothing in the inbox and that the victim never sees the sender's number, and that around 20 such messages can "render the device unusable for an extended period," with active voice calls — including emergency calls — terminated when the crash hits. His page states the malformed messages can persist through a reboot, triggering repeated crashes, and that clearing them typically requires ADB access, with a factory reset otherwise needed.

Blaszczyk's write-up states the vulnerability affects Android 12 through 17, but that Google's fix only reached Android 14 through 17. Google's official bulletin lists CVE-2026-58882 as a Critical System-component denial-of-service fix in the November 2026 bulletin, even though Blaszczyk's own timeline dates the underlying patch to Google's October 2026 security update; both pages agree on the technical cause and the affected version range.

Why this matters beyond phone users

For students and researchers working in mobile security or systems programming, CVE-2026-58882 is a compact teaching example of a problem that keeps recurring in telephony and parsing code: a length field moving from a wider integer type to a narrower one without a range check, and that narrowed value then driving memory allocation. The same pattern — read length, narrow the type, allocate — appears across parsers well beyond SMS handling, which is why the bulletin groups it with unrelated System and Kernel bugs rather than treating it as a one-off telephony quirk.

For developers working on Android-adjacent software, the bulletin is also a reminder that Google issues two patch levels each month specifically so device makers can ship the broadly applicable Framework and System fixes quickly while giving chipset vendors — MediaTek, Qualcomm, Arm, Imagination Technologies and Unisoc are all named in this bulletin — more time to validate kernel and driver-level fixes. A device is not fully patched against everything in a given month's bulletin until it reaches the later, 05-dated patch level.

What to check

Readers who want to confirm a device's exposure can check its security patch level against the 2026-11-05 string in Settings, and compare it with the CVE tables in Google's bulletin. Blaszczyk's disclosure page also links a proof-of-concept and a community-built recovery tool for devices already affected, for readers working in security labs who want to reproduce the crash under controlled conditions rather than relying on a secondhand description of it.