CVE-2026-58882 better known as SMS of Death

Privacy & Security
1

I’d like to revisit the topic of security updates focusing on a specific case. As we all know the Mudita Kompakt operating system is based on AOSP 12 , an Android version that has reached End of Life and no longer receives official security updates.

A recent example is CVE-2026-58882 (“SMS of Death”): receiving a single malformed WAP Push SMS may be enough to cause a device to crash. The vulnerability has only been fixed in AOSP 14 through 17.

So my question is, is the Mudita Kompakt affected by this vulnerability and will Mudita OS K 2.0 provide a transparent overview of which relevant security vulnerabilities have been addressed?

I know Mudita has already provided several responses on the topic of security updates. However, as far as I know, there is still no concrete overview of which CVEs have actually been fixed.

3 Likes
2

The Mudita OS K lacks a web browser, does that CVE apply out of the box?

1 Like
3

No browser needed to abuse this. An attacker sends a specially crafted message over the mobile network, which the smartphone receives in the background and processes through Android’s system component “WapPushOverSms”. In the worst case you might not even see the message.

1 Like