VULNpocalypse
MediumVulnerabilityMonitoring

GhostMap Android flaw: crafted app traps phones in boot loop, no patch yet

GhostMap lets a crafted, permissionless Android app trap phones in a crash loop. No patch exists, so install apps only from trusted stores.

Published
Exploitation
No, Bitdefender says it has not seen the technique used against real users

What happened

Bitdefender found an Android flaw it calls GhostMap. A crafted app can force a device into a continuous boot loop once it is installed. The app needs no permissions, and it does not need to be launched (BleepingComputer). Cyber Security News adds that Bitdefender’s demonstration app contains no code (Cyber Security News).

How the bug works

  • An APK is a ZIP file. Two Android libraries interpret the ZIP compression method field differently. One checks the size only for entries marked as stored, and the other treats anything not marked as deflated as stored (Cyber Security News).
  • A malformed entry can therefore bypass size checks, and Android maps it beyond the file’s real contents (BleepingComputer).
  • In one test, an APK of 8,408 bytes was mapped across about 16 MB (Cyber Security News).
  • Any process that reads past the real end of the file receives a SIGBUS fault and crashes (BleepingComputer).

Why the device loops

In the worst case, the core process system_server reads a resource from the app automatically after installation. It crashes, restarts, reads the same resource again and crashes again in a loop (BleepingComputer).

Bitdefender tested this on a Pixel 10 running Android 17 with the August 5 security patch:

  • The first crash came about one second after install.
  • The loop repeated 110 times in normal boot and 72 times in safe mode (BleepingComputer).
  • Safe mode does not help, because the service reads the file before safe mode takes effect (Cyber Security News).

What the bug does not do

According to Cyber Security News, the bug only crashes processes. It does not run code, steal data or raise permissions (Cyber Security News).

How it was found

The analysis began when a banking malware sample collected in the wild crashed Bitdefender’s emulators during installation. Bitdefender traced the cause to Android itself, not the malware. Bitdefender has not seen the technique used against real users (Cyber Security News).

Google’s response

  • Bitdefender reported the issue on August 20 and received a “Won’t Fix (Not Reproducible)” reply.
  • After an extended report on August 25, Google said the issue is outside the scope of a security update, but kept it for consideration in a future update (BleepingComputer).
  • Cyber Security News reports that no fix or CVE exists yet. It also notes that Google patched a weaker form of the issue in 2016 as CVE-2016-6724 (Cyber Security News).
  • BleepingComputer said it was still waiting for Google to reply about the fix status (BleepingComputer).

Am I affected?

  • Android version: Cyber Security News reports that the affected range starts at Android 10 (Cyber Security News). BleepingComputer does not state a version range. A full list of affected versions and devices is not confirmed.
  • Tested device: A Pixel 10 on Android 17 with the August 5 patch was affected (BleepingComputer).
  • Delivery: A harmful file could also arrive later through an app update (Cyber Security News).
  • Detection: Security scanners that open the file may crash as well (Cyber Security News). Third-party security tools may warn about the app, but they cannot block the installation (BleepingComputer).

What to do now

  1. Install apps only from trusted stores and avoid sideloaded APK files (Cyber Security News).
  2. Know your recovery options:
    • A factory reset stops the loop, but it erases local data.
    • Deleting the malformed file via ADB also works. This requires USB debugging to be enabled already, and the commands must run between crashes (BleepingComputer).
  3. Weigh USB debugging carefully. Turning it on may help recovery, but it carries its own risks (Cyber Security News).
  4. Watch for a Google fix. A patch date is not confirmed.

Update, 5 November 2026

  • Bitdefender’s investigation began August 12, when a banking dropper crashed its emulators; a packer had rewritten the APK structure
  • Bitdefender analyst Silviu Stahie said the bug is in AOSP and was tested from Android 10 up to the latest version
  • Devices from other manufacturers were not tested
  • Bitdefender declined to expand on whether a malformed app could pass app store review

Sources for this update: helpnetsecurity.com, helpnetsecurity.com

Sources