Bitdefender discloses GhostMap, an Android APK ZIP-parsing flaw that crash-loops Pixel 10 and other phones; Google declines a security fix

Linha do tempo

1. securityonline.info ↗ · pub. 10/11/2026 04:10 · coletado 10/11 05:00

   GhostMap: unpatched Android APK parser flaw traps phones in boot loops after a crafted app is installed

   ler a análise desta fonte ocultar

   Bitdefender Labs disclosed GhostMap, a parser flaw in Android that leaves a phone stuck in an endless boot loop once a crafted app is installed. The app contains no executable code and requests no permissions, and the loop continues into Safe Mode, so recovery generally requires a factory reset that erases local data. The defect lies in how libziparchive and libandroidfw interpret the compression method and declared uncompressed size of a ZIP entry, which makes system_server crash on every restart (bitdefender.com). Google closed Bitdefender's two reports as Won't Fix (Not Reproducible) and out of scope, and no security patch has been published (bitdefender.com). The threat is rated high rather than critical: no persistent boot-loop attack has been observed in the wild, the victim must install the crafted app, and the effect is local, but the flaw is unpatched and its outcome is data loss.

   Technical Details

   The investigation started on August 12, 2026, when a banking dropper collected from the wild crashed Bitdefender's emulators during installation. The sample was wrapped with a BadPack-style packer, and the packer's ZIP header rewriting also broke the installer's parsing of the manifest, so the crash was a side effect rather than an intended feature of the malware. The root cause is a disagreement between two native Android libraries: libziparchive only checks an entry's declared uncompressed size against the file size when the method is stored, while libandroidfw only recognizes deflated and treats every other 16-bit value as stored. An attacker can therefore set an arbitrary method and a huge declared length, causing Android to memory-map a tiny file across about 16 MB of unallocated space. Any process that reads past the real end of the file receives a SIGBUS signal and is killed (bitdefender.com).

   On a Google Pixel 10 running Android 17 with the August 5, 2026 security patch, the researchers reproduced the failure, and Bitdefender states that it affects all Android versions from Android 10 onward (bitdefender.com). When the malformed file is a small post-install resource that system services parse automatically, the crash hits system_server. In one capture the crash came about one second after installation and repeated 110 times while the screen stayed on the boot animation. Safe Mode does not help because the crash occurs before Safe Mode initializes (bitdefender.com). Bitdefender describes two stealthier uses that it has not observed in the wild: malforming a trojan's own icon so that the launcher, Settings or app info screens crash when the victim tries to uninstall it, and planting malformed entries that crash antivirus scanners and sandboxes that parse APKs. Bitdefender detects the malformed sample as Android.Riskware.Ghostmap.rA.

   The same weakness is related to CVE-2016-6724, a 2016 Android flaw in the Input Manager Service that Google patched and rated Moderate (bitdefender.com).

   Remediation

   • No official patch exists for Android 10 through Android 17, so there is no vendor fix to apply yet.
   • Avoid sideloading unverified APKs, since the researchers note a malicious update could also deliver the malformation after passing store review.
   • Keep regular cloud backups, because the only recovery for a looping device is a factory reset that wipes local data.
   • If USB debugging was enabled beforehand, an ADB script from a computer can delete the offending APK between system_server restarts; this window is narrow.
   • Use a mobile security product that inspects raw ZIP header structures before installation, such as the detection Bitdefender lists as Android.Riskware.Ghostmap.rA.
2. gbhackers.com ↗ · pub. 06/11/2026 02:56 · coletado 06/11 04:00

   Bitdefender discloses GhostMap, an Android APK flaw that crash-loops phones after install; Google issues no fix

   This article adds the names of the two affected Android libraries (libziparchive and libandroidfw), the comparison with BadPack manipulation (nearly 9,200 samples seen by Unit 42 from June 2023 to June 2024), and the Google report dates of August 20 and 25. It confirms the persistent-crash capability was built by the researchers and not seen in attacks, and that no fix was available.

   ler a análise desta fonte ocultar

   This article adds the names of the two affected Android libraries (libziparchive and libandroidfw), the comparison with BadPack manipulation (nearly 9,200 samples seen by Unit 42 from June 2023 to June 2024), and the Google report dates of August 20 and 25. It confirms the persistent-crash capability was built by the researchers and not seen in attacks, and that no fix was available.

   Bitdefender researchers disclosed GhostMap, an Android flaw in APK ZIP parsing. A crafted app with no executable code and no permissions can put a phone into a continuous crash loop once it is installed, without being launched. Testing reproduced it on Android 10 and later, including a Pixel 10 on Android 17 with the August 5, 2026 patch. Recovery may need a factory reset, which erases local data but does not damage hardware. Bitdefender reported the issue to Google on August 20 and 25. Google judged it outside the scope of a security-update fix and referred it for possible inclusion in a future version. No fix existed at publication. Bitdefender has not seen attackers use the persistent-crash capability.

   Technical Details

   • The research began on August 12, when a banking dropper collected in the wild crashed Bitdefender's analysis emulators during installation. That sample only caused installation failure. The persistent crash demonstration was built by the researchers.
   • Android's libziparchive validates an entry's uncompressed size against the available file space only when the compression method is explicitly stored. Unsupported method values skip that check.
   • libandroidfw treats every method other than deflate as stored and maps the entry using its declared uncompressed length.
   • An 8,408-byte APK was mapped across about 16 MB. Reading past the real end of the file raises SIGBUS and kills the reading process.
   • When a service inside system_server inspects the malformed resource, the process crashes and restarts. It then reads the same resource again, so the failure repeats before the interface becomes usable. Reboot and safe mode did not resolve it in the demonstration.
   • The flaw causes an invalid read only. No code execution, privilege escalation or data theft was shown.
   • The parsing inconsistency echoes the BadPack APK manipulation technique. Unit 42 identified nearly 9,200 BadPack samples between June 2023 and June 2024.
   • Unlike the separately reported SMS-triggered Android crashes, GhostMap needs a crafted APK to be installed, but no further interaction.
   • Other possible effects, described by the researchers and not confirmed as attacks, include crashing security scanners or uninstall interfaces that load malformed resources.

   Remediation

   • No fix was available at publication. Unrelated Android security updates should not be assumed to address GhostMap.
   • Recovery through ADB may work only under limited conditions, when debugging was already enabled. Otherwise a factory reset is needed.
   • Bitdefender detects malformed apps as Android.Riskware.Ghostmap.rA. Third-party scanners cannot independently block installation or remove another app under Android's security model.
3. infosecurity-magazine.com ↗ · pub. 05/11/2026 07:15 · coletado 05/11 08:01

   GhostMap: Android ZIP-parsing flaw (Android 10+) causes unrecoverable crash loop; Google declines a security fix

   Infosecurity Magazine adds that Bitdefender reports all Android versions from 10 upward are affected. It also adds four abuse scenarios (extortion bricking, an undeletable app, crashing security tools, delivery via app update), the detection name Android.Riskware.Ghostmap.rA, and the advice to detect the malformed file statically.

   ler a análise desta fonte ocultar

   Infosecurity Magazine adds that Bitdefender reports all Android versions from 10 upward are affected. It also adds four abuse scenarios (extortion bricking, an undeletable app, crashing security tools, delivery via app update), the detection name Android.Riskware.Ghostmap.rA, and the advice to detect the malformed file statically.

   Bitdefender disclosed GhostMap, a flaw in how Android parses ZIP entries in an APK. It found the flaw when a wild APK crashed its lab emulators, and it turned out to be an OS bug, not malware. Android mishandles the compression method and declared uncompressed length fields, so a malformed entry is mapped over memory that was never allocated. Reading it raises a SIGBUS in whichever process touches the file. The crash loop survives reboots and safe mode, so only a factory reset, which erases local data, clears it. Bitdefender says all versions from Android 10 up are affected. It notified Google on August 20, and Google called the issue outside the scope of a security fix. No patch exists at publication (infosecurity-magazine.com).

   Technical Details

   • Bitdefender describes four abuse scenarios, all theoretical and with no in-the-wild use reported: bricking a phone by crashing system_server through a malformed resource, then using it for extortion; making a malicious app impossible to uninstall by crashing the launcher, Settings and app-info screens with a malformed icon; crashing security tools, sandboxes and scanning pipelines that parse the APK; and slipping the malformed file in through an app update to bypass store checks.
   • The malformation is visible in the file structure, so a scanner can spot it statically without installing or running the app.
   • Bitdefender detects it as Android.Riskware.Ghostmap.rA.

   Remediation

   No fix is available. Bitdefender's advice is to detect the crafted file before it is installed or parsed, using static inspection. Recovery from an active crash loop requires a factory reset.

4. bleepingcomputer.com ↗ · pub. 05/11/2026 06:18 · coletado 05/11 08:00

   GhostMap Android flaw lets a permissionless malicious app trigger a persistent boot loop; Google has issued no patch

   This article adds the safe-mode loop count (72 cycles), the two recovery options (factory reset, or ADB deletion that needs debugging already enabled and must run before the crash), the point that third-party security tools can warn but cannot block installation, and that BleepingComputer's request for comment to Google is unanswered.

   ler a análise desta fonte ocultar

   This article adds the safe-mode loop count (72 cycles), the two recovery options (factory reset, or ADB deletion that needs debugging already enabled and must run before the crash), the point that third-party security tools can warn but cannot block installation, and that BleepingComputer's request for comment to Google is unanswered.

   Bitdefender disclosed GhostMap, an Android flaw in which two libraries interpret ZIP compression methods differently. A malformed APK can therefore bypass size checks and be mapped past the end of the file. Reading such an entry raises a SIGBUS in the reading process. Bitdefender built a demo app with no executable code that requests no permissions and never has to be launched. Once installed, it sends system_server into an endless crash loop. Bitdefender reported the issue to Google on August 20 and got "Won't Fix (Not Reproducible)". An extended report on August 25 was still judged out of scope for a security update, though Google reserved it for a possible future release. No CVE is mentioned in the article. BleepingComputer had no reply from Google at publication.

   Technical Details

   • Bitdefender found the flaw while analyzing an Android banking trojan that kept crashing its emulators when it read an application resource.
   • The test device was a Pixel 10 running Android 17 with the August 5 security patch. The crash loop began about one second after installation. It repeated 110 times in normal boot mode and 72 times in safe mode, so safe mode gives no way out.

   Remediation

   • No patch exists.
   • A factory reset clears the loop but erases all local data.
   • Deleting the malformed file over ADB also works. It needs USB debugging already enabled, and the commands must run before the system crashes.
   • The only chance to block the attack is at installation. Third-party security tools may detect the app and show a warning, but they have no permission to block the install.
5. helpnetsecurity.com ↗ · pub. 05/11/2026 06:00 · coletado 05/11 06:01 primeiro registro

   Bitdefender discloses GhostMap, an Android ZIP-parsing flaw that crash-loops Pixel 10 phones; Google issues no fix

   ler a análise desta fonte ocultar

   Bitdefender Labs disclosed GhostMap, an Android flaw in how the platform parses the ZIP structure inside an APK. An app with no executable code and no permissions can leave a Pixel 10 (Android 17, August 5, 2026 patch) in a crash loop that may need a factory reset to clear. Bitdefender has not seen it used in the wild. Google closed the first report (August 20) as Won't Fix (Not Reproducible). After a proof of concept on August 25, Google called the issue outside the scope of a security fix and passed it to a team for possible inclusion in a future version. No CVE has been assigned.

   Technical Details

   • A banking dropper collected on August 12 crashed Bitdefender's analysis emulators. A packer had rewritten its APK structure, and that also broke Android's installer.
   • Each ZIP entry declares a 16-bit compression method and an uncompressed size. Android supports only stored and deflated entries.
   • One library checks the declared size only for stored entries. A second treats any non-deflated entry as stored and maps it into memory at the declared size. An entry with a third method value passes both checks.
   • The kernel allows a mapping larger than the file. An 8,408-byte APK was mapped across about 16 MB. The first read past the real end of the file triggers a SIGBUS that kills the reading process.
   • A malformed manifest crashes the installer. A malformed resource read by system_server crashes it on every restart. One capture shows 110 cycles with the boot animation stuck, and safe mode loops the same way.
   • Bitdefender says the bug is in AOSP and was tested from Android 10 to the latest version. Other manufacturers' phones were not tested.
   • Bitdefender says earlier Zimperium research on malformed APKs only crashed analysis tools, while those apps still ran on devices.
   • Bitdefender raises the possibility of delivering such an app through an app store update, but does not say whether Google Play review would catch it.

   Remediation

   No patch is planned. A factory reset erases data on the phone. The article gives no other mitigation.